USDA Final Rule on Possession, Use, and Transfer of Biological Agents and Toxins

Federal Register: March 18, 2005 (Volume 70, Number 52)
Rules and Regulations
Page 13241-13292

[[Page 13241]]

-----------------------------------------------------------------------

Part II

Department of Agriculture

-----------------------------------------------------------------------

Animal and Plant Health Inspection Service

-----------------------------------------------------------------------

7 CFR Part 331 and 9 CFR Part 121

Agricultural Bioterrorism Protection Act of 2002; Possession, Use, and
Transfer of Biological Agents and Toxins; Final Rule

[[Page 13242]]

-----------------------------------------------------------------------

DEPARTMENT OF AGRICULTURE

Animal and Plant Health Inspection Service

7 CFR Part 331 and 9 CFR Part 121

[Docket No. 02-088-4]
RIN 0579-AB47

Agricultural Bioterrorism Protection Act of 2002; Possession,
Use, and Transfer of Biological Agents and Toxins

AGENCY: Animal and Plant Health Inspection Service, USDA.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: We are adopting as a final rule, with changes, an interim rule
that established regulations governing the possession, use, and
transfer of biological agents and toxins that have been determined to
have the potential to pose a severe threat to public health and safety,
to animal health, to plant health, or to animal or plant products. This
action is necessary to protect animal and plant health, and animal and
plant products.

DATES: Effective Date: The amendments to the list of PPQ select agents
and toxins in 7 CFR 331.3(b) are effective March 10, 2005. The
remaining provisions of this final rule are effective April 18, 2005.

FOR FURTHER INFORMATION CONTACT: For information concerning the
regulations in 7 CFR part 331, contact Dr. Charles L. Divan, Senior
Agricultural Microbiologist, Pest Permit Evaluations, Biological and
Technical Services, PPQ, APHIS, 4700 River Road Unit 133, Riverdale, MD
20737-1236, (301) 734-8758.
For information concerning the regulations in 9 CFR part 121,
contact Dr. Lee Ann Thomas, Director, Animals, Organisms and Vectors,
and Select Agents, VS, APHIS, 4700 River Road Unit 2, Riverdale, MD
20737-1231, (301) 734-5960.

SUPPLEMENTARY INFORMATION:

Background

On June 12, 2002, the President signed into law the Public Health
Security and Bioterrorism Preparedness and Response Act of 2002 (Pub.
L. 107-188). Title II of Pub. L. 107-188, ``Enhancing Controls on
Dangerous Biological Agents and Toxins'' (sections 201 through 231),
provides for the regulation of certain biological agents and toxins by
the Department of Health and Human Services (subtitle A, sections 201-
204) and the Department of Agriculture (subtitle B, sections 211-213),
and provides for interagency coordination between the two departments
regarding overlap agents and toxins (subtitle C, section 221). Subtitle
D (section 231) provides for criminal penalties regarding certain
biological agents and toxins. For the Department of Health and Human
Services, the Centers for Disease Control and Prevention (CDC) has been
designated as the agency with primary responsibility for implementing
the provisions of the Act; the Animal and Plant Health Inspection
Service (APHIS) is the agency fulfilling that role for the Department
of Agriculture (USDA). The Criminal Justice Information Services (CJIS)
Division of the Federal Bureau of Investigation has been designated as
the agency with primary responsibility for implementing the Attorney
General's responsibilities under the Act (i.e., the security risk
assessments).
In subtitle B (which is cited as the ``Agricultural Bioterrorism
Protection Act of 2002'' and referred to below as the Act ), section
212(a) provides, in part, that the Secretary of Agriculture (the
Secretary) must establish by regulation a list of each biological agent
and each toxin that the Secretary determines has the potential to pose
a severe threat to animal or plant health, or to animal or plant
products. The Act further requires (under section 213(b)) that all
persons in possession of any listed biological agent or toxin must,
within 60 days of the publication of that regulation, notify the
Secretary of such possession.
In accordance with these statutory requirements, on August 12,
2002, we published in the Federal Register (67 FR 52383-52389, Docket
No. 02-082-1) an interim rule that established the initial lists of
biological agents and toxins and set out the manner in which persons in
possession of listed agents and toxins were to provide notice of such
possession.
Section 212 of the Act also required the Secretary to provide by
regulation for the establishment and enforcement of standards and
procedures governing the possession, use, and transfer of listed
biological agents and toxins in order to protect animal and plant
health, and animal and plant products. Specifically, sections 212(b)
and (c) required that the Secretary:
Establish and enforce safety procedures for listed agents
and toxins, including measures to ensure proper training and
appropriate skills to handle agents and toxins, and proper laboratory
facilities to contain and dispose of agents and toxins;
Establish and enforce safeguard and security measures to
prevent access to listed agents and toxins for use in domestic or
international terrorism or for any other criminal purpose;
Establish procedures to protect animal and plant health,
and animal and plant products, in the event of a transfer or potential
transfer of a listed agent or toxin in violation of the safety
procedures and safeguard and security measures established by the
Secretary; and
Ensure appropriate availability of biological agents and
toxins for research, education, and other legitimate purposes.
In an interim rule published in the Federal Register on December
13, 2002 (67 FR 76908-76938, Docket No. 02-088-1) and effective on
February 11, 2003, we established regulations in 7 CFR part 331 and 9
CFR part 121 governing the possession, use, and transfer of biological
agents and toxins that have been determined to have the potential to
pose a severe threat to both human and animal health, to animal health,
to plant health, or to animal or plant products. These CFR parts are
referred to below as the regulations. We solicited comments concerning
the interim rule for 60 days ending February 11, 2003. We received 36
written comments. They were from academic institutions, professional
associations, corporations, nonprofit organizations, individuals, and
representatives of State and Federal Governments. These comments, as
well as oral comments presented at a public meeting on December 16,
2002, are discussed by topic below.
Also on December 13, 2002, CDC published in the Federal Register
(67 FR 76886-76905) an interim rule that established the standards and
procedures governing the possession, use, and transfer of certain
biological agents and toxins (referred to by CDC as select agents and
toxins) (42 CFR part 73).
On November 3, 2003, APHIS and CDC published in the Federal
Register (68 FR 62218-62221, Docket No. 02-088-3; and 68 FR 62245-
62247) interim rules that amended both agencies' regulations in order
to allow for the issuance of provisional registration certificates for
individuals and entities and provisional grants of access to listed
biological agents and toxins for individuals. These provisional
measures provided additional time for the Attorney General to complete
security risk assessments for those individuals and entities for which
the Attorney General received, by November 12, 2003, all of the
information required to conduct a security risk assessment. We
solicited comments concerning the

[[Page 13243]]

interim rules for 60 days ending January 2, 2004. We did not receive
any comments by that date.
APHIS and CDC collaborated closely on the December 13, 2002, and
November 3, 2003, interim rules, as well as on this final rule and
CDC's final rule also issued in today's Federal Register. Below is a
summary of the changes we are making to the regulations in this final
rule. We refer to the regulations in place prior to the effective date
of this final rule as the ``interim'' regulations, or ``interim'' 7 CFR
331.4, for example, when we need to distinguish between the regulations
established by the interim rules of December 2002 and November 2003 and
this final rule.

Summary of Changes Made in Final Rule

1. We are revising the format of the regulations in 7 CFR part 331
and 9 CFR part 121 so that the sections numbers and, to the extent
possible, the section titles and the information contained in each
section is the same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part
73.
2. We are changing the terms ``biological agents and/or toxins,''
``listed agents and/or toxins,'' and ``high consequence livestock
pathogens'' to ``select agents and toxins'' or ``select agents or
toxins'' throughout 7 CFR part 331 and 9 CFR part 121. In addition, in
9 CFR part 121, we are removing the term ``overlap agents'' each time
it appears and adding ``overlap select agents and/or toxins'' in its
place.
3. We are changing the title of 7 CFR part 331 and 9 CFR part 121
from ``Possession, Use, and Transfer of Biological Agents and Toxins''
to ``Possession, Use, and Transfer of Select Agents and Toxins.''
4. We are removing Phakopsora pachyrhizi and plum pox potyvirus
from the list of PPQ select agents and toxins.
5. We are removing Newcastle disease virus (VVND) from the list of
VS select agents and toxins and adding Newcastle disease virus
(velogenic) in its place to make it clear that we are regulating all of
the velogenic strains.
6. We are removing Clostridium botulinum from the list of overlap
select agents and toxins but we are continuing to list Botulinum
neurotoxin producing species of Clostridium.
7. We are adopting CDC's approach for genetic elements and,
therefore, we will consider the following to be select agents and
toxins:
Nucleic acids that can produce infectious forms of any of
the select agent viruses listed in either 7 CFR part 331 or 9 CFR part
121;
Recombinant nucleic acids that encode for the functional
forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if
the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are
in a vector or recombinant host genome and can be expressed in vivo or
in vitro; and
Select agents and toxins listed in either 7 CFR part 331
or 9 CFR part 121 that have been genetically modified.
8. We are broadening the scope of the overlap toxin exclusion to
cover overlap toxins under the control of a principal investigator,
treating physician or veterinarian, or commercial manufacturer or
distributor.
9. We are amending the exemption provisions by requiring, as
another condition of exemption, that the select agent or toxin be
secured against theft, loss, or release during the period between
identification of the agent or toxin and transfer or destruction of
such agent or toxin.
10. We are amending the exemption provisions in 9 CFR part 121 by
requiring immediate reporting after identification of specified select
agents and toxins; identification of the other select agents and toxins
must be reported within 7 calendar days after identification.
11. We are amending the exemption provisions to allow the
Administrator to make exceptions to the timeframes for transfer or
destruction of a select agent or toxin, as necessary.
12. We are amending the registration sections to set out a new
framework for submitting registration applications to APHIS or CDC.
13. We are amending the registration sections in 7 CFR part 331 and
9 CFR part 121 to provide:
Federal, State, or local governmental agencies, including
public institutions of higher education, are exempt from the security
risk assessment for the entity and the individual who owns or controls
such entity.
For a private institution of higher education, an
individual will be deemed to own or control the entity if the
individual is in a managerial or executive capacity with regard to the
entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
For entities other than institutions of higher education,
an individual will be deemed to own or control the entity if the
individual: (1) Owns 50 percent or more of the entity, or is a holder
or owner of 50 percent or more of its voting stock; or (2) is in a
managerial or executive capacity with regard to the entity's select
agents or toxins or with regard to the individuals with access to the
select agents or toxins possessed, used, or transferred by the entity.
An entity will be considered to be an institution of
higher education if it is an institution of higher education as defined
in section 101(a) of the Higher Education Act of 1965 (20 U.S.C.
1001(a)), or is an organization described in 501(c)(3) of the Internal
Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).
14. We are amending the registration sections to provide that a
certificate of registration will be valid for one physical location (a
room, a building, or a group of buildings) where the responsible
official will be able to perform the responsibilities required in this
part, for specific select agents or toxins, and for specific
activities.
15. We are amending the registration sections to require that,
prior to any change, the responsible official must apply for an
amendment to a certificate of registration by submitting the relevant
page(s) of the registration application.
16. We are amending the registration sections to provide that an
entity must immediately notify APHIS or CDC if it loses the services of
its responsible official. An entity may continue to possess or use
select agents or toxins only if it appoints as the responsible official
another individual who has been approved by the Administrator or the
HHS Secretary following a security risk assessment by the Attorney
General and who meets the requirements of the regulations.
17. We are amending the sections pertaining to denial, revocation,
and suspension of registration by requiring that, upon notification of
suspension or revocation, an individual or entity must:
Immediately stop all use of each select agent or toxin
covered by the revocation or suspension order;
Immediately safeguard and secure each select agent or
toxin covered by the revocation or suspension order from theft, loss,
or release; and
Comply with all disposition instructions issued by the
Administrator for each select agent or toxin covered by the revocation
or suspension.
18. We are amending the responsible official sections to require
the responsible official to report the identification and final
disposition of any select agent or toxin contained in a specimen
presented for diagnosis or verification. We are also amending the
responsible official section in 9 CFR 121.9 to require the responsible
official to report the identification and final disposition of any
select agent or toxin

[[Page 13244]]

contained in a specimen presented for proficiency testing.
19. We are amending the provisions relating to access approvals to
state that an individual will be deemed to have access at any point in
time if the individual has possession of a select agent or toxin (e.g.,
carries, uses, or manipulates) or the ability to gain possession of a
select agent or toxin.
20. We are amending the provisions pertaining to access approval to
provide that an individual's access approval may be revoked if the
individual is within any of the categories specified in the
regulations.
21. We are amending the security sections to clarify that the
security plan must be sufficient to safeguard the select agent or toxin
against unauthorized access, theft, loss, or release.
22. We are adding the provisions for restricted experiments to 7
CFR part 331 and we are amending these provisions in 7 CFR part 331 and
9 CFR part 121 to indicate that these experiments must be conducted
under any conditions prescribed by the Administrator.
23. We are amending the training sections to require that
information and training on biocontainment/biosafety and security be
provided to each individual with access approval from the Administrator
or the HHS Secretary before he/she has access and to each individual
not approved for access by the Administrator or the HHS Secretary
before he/she works in or visits areas where select agents or toxins
are handled or stored (e.g., laboratories, growth chambers, animal
rooms, greenhouses, storage areas, etc.).
24. We are amending the transfer section in 9 CFR 121.16 to set out
the requirements for transfer of a select agent or toxin contained in a
specimen for proficiency testing.
25. We are amending the transfer sections to provide that, on a
case-by-case basis, the Administrator may authorize a transfer of a
select agent or toxin not otherwise eligible for transfer under the
regulations under conditions prescribed by the Administrator.
26. We are amending the transfer sections to provide that an
authorization for a transfer shall be valid only for 30 calendar days
after issuance, except that such an authorization becomes immediately
null and void if any facts supporting the authorization changes (e.g.,
change in the certificate of registration for the sender or recipient,
change in the application for transfer).
27. We are amending the records sections to require the maintenance
of an accurate, current inventory for each toxin held and for each
select agent held in long-term storage (placement in a system designed
to ensure viability for future use, such as in a freezer or lyophilized
materials).
28. We are amending the section pertaining to notification of
theft, loss, or release in 7 CFR part 331 to require that APHIS or CDC
be notified immediately upon discovery of a release of a select agent
or toxin outside of the primary barriers of the biocontainment area and
we are amending this section in 9 CFR part 121 to require that APHIS or
CDC be notified immediately upon discovery of a release of a select
agent or toxin causing occupational exposure or a release outside of
the primary barriers of the biocontainment area.
29. We are amending the administrative review sections to allow an
individual to appeal revocation of access approval.

Format of the Regulations

APHIS and CDC are revising the format of the regulations in the
final rules so that the section numbers and, to the extent possible,
the section titles and the information contained in each section is the
same in 7 CFR part 331, 9 CFR part 121, and 42 CFR part 73. These
changes should make the regulations easier to use and facilitate
compliance. The chart below sets out the format of 7 CFR part 331 and 9
CFR part 121 set by the interim rules (interim regulations) and the new
format for the regulations in 7 CFR part 331 and 9 CFR part 121 (final
rule).

------------------------------------------------------------------------
Interim regulations Final rule
------------------------------------------------------------------------
331.0 Effective and applicability dates
121.0 Effective and applicability dates
331.1 Definitions...................... 331.1 Definitions.
121.1 Definitions...................... 121.1 Definitions.
331.2 Purpose and scope................ 331.2 Purpose and scope.
121.2 Purpose and scope................ 121.2 Purpose and scope.
331.3 List of biological agents and 331.3 PPQ select agents and
toxins. toxins.
121.3 List of biological agents and 121.3 VS select agents and
toxins. toxins.
331.4 Exemptions....................... 331.4 [Reserved].
121.4 Exemptions for overlap agents or 121.4 Overlap select agents and
toxins. toxins.
331.5 Registration; who must register.. 331.5 Exemptions.
121.5 Exemptions for animal agents and 121.5 Exemptions for VS select
toxins. agents and toxins.
331.6 Registration; general provisions. 331.6 [Reserved]
121.6 Registration; who must register.. 121.6 Exemptions for overlap
select agents and toxins.
331.7 Denial, revocation, or suspension 331.7 Registration and related
of registration. security risk assessments.
121.7 Registration; general provisions. 121.7 Registration and related
security risk assessments.
331.8 Registration; how to register.... 331.8 Denial, revocation, or
suspension of registration.
121.8 Denial, revocation, or suspension 121.8 Denial, revocation, or
of registration. suspension of registration.
331.9 Responsibilities of the 331.9 Responsible official.
responsible official.
121.9 Registration; how to register.... 121.9 Responsible official.
331.10 Restricting access to biological 331.10 Restricting access to
agents and toxins. select agents and toxins;
security risk assessments.
121.10 Responsibilities of the 121.10 Restricting access to
responsible official. select agents and toxins;
security risk assessments.
331.11 Biocontainment and security plan 331.11 Security.
121.11 Restricting access to biological 121.11 Security.
agents and toxins.
331.12 Training........................ 331.12 Biocontainment.
121.12 Biosafety and security plan..... 121.12 Biosafety.
331.13 Transfer of biological agents 331.13 Restricted experiments.
and toxins.
121.13 Training........................ 121.13 Restricted experiments.
331.14 Records......................... 331.14 Incident response.
121.14 Transfer of biological agents 121.14 Incident response.
and toxins.
331.15 Inspections..................... 331.15 Training.

[[Page 13245]]

121.15 Records......................... 121.15 Training.
331.16 Notification in the event of 331.16 Transfers.
theft, loss, or release of a
biological agent or toxin.
121.16 Inspections..................... 121.16 Transfers.
331.17 Administrative review........... 331.17 Records.
121.17 Notification in the event of 121.17 Records.
theft, loss, or release of a
biological agent or toxin.
121.18 Administrative review........... 331.18 Inspections.
121.18 Inspections.
331.19 Notification of theft,
loss, or release.
121.19 Notification of theft,
loss, or release.
331.20 Administrative review.
121.20 Administrative review.
------------------------------------------------------------------------

General Comments

A commenter suggested that APHIS and CDC adopt consistent
terminology when referring to biological agents and toxins. The
commenter pointed out that the regulations use the following terms:
biological agents and toxins, select agents and toxins, overlap agents,
and high consequence pathogens.
We agree that APHIS and CDC should use consistent terminology.
Therefore, in this final rule, we are removing the terms ``biological
agents and/or toxins,'' ``listed agents and/or toxins,'' and ``high
consequence livestock pathogens'' each time they appear in 7 CFR part
331 and/or 9 CFR part 121 and adding ``select agents and/or toxins'' in
their place. In addition, in 9 CFR part 121, we are removing the term
``overlap agents'' each time it appears and adding ``overlap select
agents and/or toxins'' in its place. To reflect this change in
terminology, we are also changing the title of both parts from
``Possession, Use, and Transfer of Biological Agents and Toxins'' to
``Possession, Use, and Transfer of Select Agents and Toxins.'' In
accordance with these changes, we will be using the term ``select agent
and/or toxin'' throughout the preamble of this rule. When it is
necessary to specify the type of select agent or toxin, we will use the
following terms: ``PPQ select agent and/or toxin'' (for the plant
agents and toxins), ``VS select agent and/or toxin'' (for the animal
agents and toxins), or ``overlap select agent and/or toxin.'' Unless
otherwise specified, the term ``select agent and/or toxin'' will refer
to all agents or toxins listed by APHIS.
One commenter stated that APHIS and CDC should harmonize the
regulations and provide consistent guidance to entities. This commenter
also recommended close collaboration between the agencies for
registration, enforcement, and compliance assistance. Another commenter
recommended that APHIS and CDC establish one regulatory and reporting
mechanism and one office of compliance assistance and enforcement in
order to enhance coordination between APHIS and CDC.
We agree that APHIS and CDC should harmonize the regulations and
provide consistent guidance to entities. APHIS and CDC have worked
closely together to identify and resolve differences between the
regulations. This final rule is consistent with CDC's final rule in
both structure and substance. APHIS and CDC have also established
procedures that will allow an entity to interact with only one agency--
either APHIS or CDC--with respect to most matters involving select
agents and toxins. These changes will ensure the close coordination of
APHIS and CDC and create a uniform and consistent approach to the
regulation of select agents and toxins. APHIS and CDC are also
developing a single shared web-based system that will allow the
regulated community to conduct transactions electronically with APHIS
and CDC via a single web portal. By providing a single web portal,
APHIS and CDC will be able to interact efficiently and effectively with
the regulated community while reducing the burden on the public. We
envision that this system will enable the entity to dynamically
communicate with APHIS and CDC in a digitally secured environment using
a single web portal. The web portal will provide a platform for
electronic exchange of information. It will allow entities to access
data related to their own registration data and allow them to create,
amend, and submit registration applications; requests for approvals for
transfers, exemptions, or exclusions; and any other required forms
without the need to print, mail, or e-mail hard copies. Hard copy
registration materials and other required forms will still be accepted.
The single web portal will be available in winter 2005.
A number of commenters expressed concern about the effect of the
regulations on the scientific community. Several commenters stated that
the regulations will limit the free exchange of scientific information
and make it difficult to recruit foreign researchers and technical
workers in areas of short supply in the United States. Several
commenters asserted that the costs of the regulations (especially the
security requirements) will result in the termination of important
research projects and the destruction of specimens. One commenter
stated that research programs will be terminated because researchers
will not want to deal with the new regulatory requirements or their
institutions will not want to be liable for violations of the
regulations. This commenter also noted that the costs of adhering to
the regulations will limit the money available for the research.
Another commenter stated that scientists will end up spending more time
dealing with bureaucratic requirements rather than working in the
laboratory or supervising their employees.
The Act requires the Secretary to establish, by regulation,
standards and procedures governing the possession, use, and transfer of
listed biological agents and toxins in order to protect animal and
plant health, and animal and plant products. In an interim rule
published in the Federal Register on December 13, 2002, and effective
on February 11, 2003, APHIS established the regulations required under
the Act. To date, the commenters' concerns about the costs or
difficulties of complying with the regulations have failed to
materialize. Accordingly, we are making no changes in response to these
comments.
Several commenters requested that APHIS and CDC create a grant
program to assist entities with the costs of implementing the security
requirements.
At this time APHIS is unable to assist entities with the costs of
implementing the security requirements because

[[Page 13246]]

Congress has not appropriated any funds to establish such a grant
program. Accordingly, we are making no change based on these comments.
One commenter requested that APHIS specify in the final rule that
it is the regulatory agency for the veterinary biologics industry.
An entity in the veterinary biologics industry may be regulated by
APHIS and/or CDC, depending on the agent or toxin that it possesses,
uses, or transfers--overlap select agents and toxins are regulated by
both APHIS and CDC, while VS select agents and toxins are regulated
only by APHIS. For this reason, we are making no change in response to
this comment.
A commenter stated that the regulations should be revoked and
replaced with prohibitions on owning, working with, or importing any of
the agents or products. This commenter recommended that the penalty for
possession of a select agent be a fine of $500,000 or imprisonment for
up to 25 years.
The Act does not authorize APHIS to prohibit the possession, use,
or transfer of biological agents and toxins. Rather, section 212 of the
Act directs APHIS to establish, by regulation, standards and procedures
governing the possession, use, and transfer of biological agents and
toxins that have been determined to have the potential to pose a severe
threat to both human and animal health, to animal health, to plant
health, or to animal or plant products. The Act also sets forth the
civil and criminal penalties for violations of the Act. For these
reasons, we are making no changes based on this comment.
One commenter warned of the potential for international travelers
to bring biological ``suitcase bombs'' into the United States from
countries with bovine spongiform encephalopathy, foot-and-mouth
disease, or other exotic animal disease pathogens.
This commenter appears to be concerned about the introduction of
animal disease pathogens into the United States in the luggage of
international travelers. This comment is outside the scope of this
rulemaking. However, we note that VS select agents or toxins and
overlap select agents or toxins may only be imported into the United
States in accordance with 9 CFR parts 121 and 122. We are making no
change based on this comment.

Protection of Information Collected by APHIS

Several commenters expressed concern about APHIS' ability to
protect the information collected under the regulations. One commenter
asked how APHIS would store and protect the information collected.
Another commenter stated that USDA should ensure that the information
collected is not available through Freedom of Information Act requests.
Section 212(h) of the Act sets forth the requirements relating to
the disclosure of information by APHIS and other Federal agencies.
Specifically, section 212(h)(1) provides that the specified Federal
agencies may not disclose under 5 U.S.C. 552 any of the following: (1)
Any registration or transfer documentation, permits issued prior to the
enactment of the Act, or information derived therefrom to the extent
that it identifies the agent or toxin possessed, used, or transferred
by a specific person or discloses the identity or location of a
specific person; (2) the national database or any other compilation of
the registration or transfer information to the extent that such
compilation discloses site-specific registration or transfer
information; (3) any portion of a record that discloses the site-
specific or transfer-specific safeguard and security measures used by a
registered person to prevent unauthorized access to agents and toxins;
(4) any notification of a theft, loss, or release of an agent or toxin;
and (5) any portion of an evaluation or report of an inspection of a
specific registered person that identifies the agent or toxin possessed
by a specific registered person if the agency determines that public
disclosure of the information would endanger animal or plant health, or
animal or plant products. We believe the Act provides sufficient
protection for the information collected under the regulations.
Accordingly, we are making no changes based on these comments.
A commenter stated the rule should explicitly state that the
security risk assessment is confidential.
As previously noted, we believe the Act provides sufficient
protection for the information collected under the regulations. We do
not believe it is necessary to state in the regulations that the
security risk assessment is confidential. Therefore, we are making no
change based on this comment.
Another commenter asserted that the information collected by APHIS
for the security risk assessment should not be used more broadly than
to determine who is a ``restricted person.'' The commenter noted that
California State law prohibits discrimination in employment based upon
citizenship and prohibits the disclosure of citizenship information to
a third party in a manner that links that information to the
individual, except in limited and compelling circumstances. The
commenter expressed concern that the data collected for registration or
a security risk assessment might be used inappropriately by a Federal
agency to assess a proposal for funding. The commenter recommended that
APHIS, CDC, and the Department of Justice take steps to ensure the
security and confidentiality of submitted information.
In accordance with the Act, the information submitted by an
individual as part of a security risk assessment may only be used to
determine if an individual is a restricted person under 18 U.S.C. 175b
or is reasonably suspected by any Federal law enforcement or
intelligence agency of (1) committing a crime set forth in 18 U.S.C.
2332b(g)(5), (2) knowing involvement with an organization that engages
in domestic or international terrorism (as defined in 18 U.S.C. 2331)
or with any other organization that engages in intentional crimes of
violence, or (3) being an agent of a foreign power as defined in 50
U.S.C. 1801. We believe that the Act and other applicable Federal laws,
such as the Privacy Act, are sufficient to ensure the confidentiality
of the submitted information. We are making no change in response to
this comment.
A commenter asked how APHIS inspectors will mark and protect their
inspection reports. APHIS inspection reports and related documents will
be protected in accordance with the Act and agency and departmental
policies.

Economic Impact

Several commenters argued that the costs of compliance were grossly
understated in the economic analysis for the December 2002 interim
rule. One commenter stated that the one-time cost to retrofit existing
facilities will easily exceed $1 million and that recurring annual
costs could top $100,000.
Although the commenter didn't specify, we believe that the
commenter is referring to the costs to upgrade security. In our
December 2002 economic analysis, we provided estimates of the costs of
the interim security requirements. However, we noted that these
estimates may not apply to every entity due to the diversity in
existing security levels and security needs, as well as the various
methods of meeting the interim security requirements. In the economic
analysis in this final rule, we reiterate that the costs to comply with
the security requirements are site specific and will vary accordingly.
Another commenter stated that the interim rule ignored or grossly
underestimated financial costs,

[[Page 13247]]

including the costs of verifying the baseline inventory and the costs
of responding to lost vial reports. The commenter estimated that the
one-time cost to verify the baseline inventory will be $2 million with
recurring costs of about $1 million per year. The commenter also
estimated that it will cost about $5 million per year to respond to
reports of lost vials of select agents because the response would
require, at least, a verification of the inventory.
In response to this comment, the economic analysis in this final
rule provides more information about the costs of the inventory
recordkeeping requirements. In this final rule, we estimate that it
would cost an entity $7,200 to create a baseline inventory (assuming an
average of 10 freezers and 3 toxin containers per entity). Assuming
that registered entities would have to re-inventory one-half of their
freezers each year to maintain an accurate and current inventory, we
estimate the total yearly inventory cost for all affected entities to
be $274,000. Finally, in the event of a theft or loss, we expect an
entity would conduct an inventory of the affected storage freezer or
toxin container. We estimate that such an inventory would cost $560 per
occurrence.

Effective and Applicability Dates

Interim 7 CFR 331.0 and 9 CFR 121.0 provided that the regulations
in each part became effective on February 11, 2003. To minimize the
disruption of research or educational projects, both sections also
provided additional time for individuals and entities to reach full
compliance with the regulations in each part (i.e., a phase-in period).
Finally, as established in the November 3, 2003, interim rule, both
sections provided for the issuance of provisional certificates of
registration and provisional grants of access for individuals under
certain conditions.
A number of commenters requested clarification of the provisions
for the phase-in period and several commenters requested additional
time to comply with certain provisions. Given that all of the dates in
7 CFR 331.0 and 9 CFR 121.0 have passed, the sections are no longer
applicable and the issues raised by the commenters are moot.
Accordingly, in this final rule, we are removing 7 CFR 331.0 and 9 CFR
121.0.

Definitions

In 7 CFR 331.1 and 9 CFR 121.1, we define the terms used in the
regulations. We are adding definitions of diagnosis and verification in
both sections in this final rule. Diagnosis is defined as ``the
analysis of specimens for the purpose of identifying or confirming the
presence or characteristics of a select agent or toxin provided that
such analysis is directly related to protecting the public health or
safety, animal health or animal products, or plant health or plant
products.'' Verification is defined as ``the demonstration of obtaining
established performance (e.g., accuracy, precision, and the analytical
sensitivity and specificity) specifications for any procedure used for
diagnosis.'' In addition, in 9 CFR 121.1, we are amending the
definition of proficiency testing. Proficiency testing is defined as
``the process of determining the competency of an individual or
laboratory to perform a specified test or procedure.'' Finally, we are
deleting the definition for diagnostic laboratory in both sections and
we are deleting the definition for clinical laboratory in 9 CFR 121.1.
These changes will clarify the exemption provisions and help to ensure
that APHIS and CDC consistently apply these provisions.
To be consistent with CDC's definitions, we are adopting CDC's
definitions for HHS Secretary and HHS select agent and/or toxin in both
sections in this final rule. HHS Secretary is defined as ``the
Secretary of the Department of Health and Human Services or his or her
designee, unless otherwise specified.'' HHS select agent and/or toxin
is defined as ``a biological agent or toxin listed in 42 CFR 73.3.''
A commenter suggested that APHIS and CDC adopt consistent
terminology when referring to biological agents and toxins. As
previously noted, in this final rule we are adopting the terms ``select
agents and/or toxins'' and ``overlap select agents and/or toxins.'' To
reflect this change in terminology, we are adding several additional
definitions to the regulations.
In 7 CFR 331.1 and 9 CFR 121.1, we are adding a definition for the
term select agent and/or toxin. However, due to differences between the
plant-related regulations in 7 CFR part 331 and the animal-related
regulations in 9 CFR part 121, the term select agent and/or toxin is
defined differently in both parts. In 7 CFR 331.1, select agent and/or
toxin is defined as ``a biological agent or toxin listed in Sec.
331.3'' while in 9 CFR 121.1 it is defined as ``unless otherwise
specified, all of the biological agents and toxins listed in Sec. Sec.
121.3 and 121.4.'' The latter definition takes into account the fact
that overlap select agents and toxins are also regulated under 9 CFR
part 121.
In 9 CFR 121.1, we are removing the definition for overlap agent or
toxin and adding a definition for overlap select agent and/or toxin in
its place. Overlap select agent and/or toxin is defined as ``a
biological agent or toxin that is listed in 9 CFR 121.4 and 42 CFR
73.4.'' We are also adding definitions for VS and VS select agent and/
or toxin in Sec. 121.1. VS is defined as ``the Veterinary Services
Programs of the Animal and Plant Health Inspection Service'' and VS
select agent and/or toxin is defined as ``a biological agent or toxin
listed in Sec. 121.3.''
One commenter claimed that the term ``entity'' is subject to
interpretation. The commenter stated that it does not make sense for a
large multi-campus university to base cumulative limits on toxins or
the designation of the responsible official on the entity when the
actual labs are separated by hundreds of miles. Another commenter
stated the definition of ``entity'' should be amended to permit a
responsible official to discharge his or her responsibilities at
several adjacent addresses.
These issues are addressed below in the registration section. We
are making no change to the definitions section in 7 CFR 331.1 and 9
CFR 121.1 based on these comments.
One commenter recommended that APHIS and CDC adopt a common
definition for the term ``responsible official.'' The commenter noted
that APHIS defines the term ``responsible official'' but CDC does not.
The commenter stated that APHIS indicates a responsible manager should
be the responsible official for an entity, while CDC would allow a
biosafety officer to assume this role. The commenter stated that, in
general, a biosafety officer would not have direct control over either
the affected staff or budgets in order to ensure compliance with the
regulations.
We agree that APHIS and CDC should adopt a common definition for
the term ``responsible official.'' Accordingly, we are amending the
definition for responsible official in this final rule. In 7 CFR 331.1
and 9 CFR 121.1, we define responsible official as ``the individual
designated by an entity with the authority and control to ensure
compliance with the regulations in this part.'' CDC is adopting the
same definition in its final rule.
A commenter stated that APHIS should clarify the term ``facility.''
The commenter said the term appears to refer to a complete building or
complex in some parts of the rule but to an individual laboratory/room
in other parts of the rule.
APHIS uses the term ``facility'' in the definition for diagnostic
laboratory in 7 CFR 331.1 and in the definitions for clinical
laboratory and diagnostic

[[Page 13248]]

laboratory in 9 CFR 121.1. The term does not appear elsewhere in the
regulations. Accordingly, we are making no change based on this
comment.
A commenter recommended that APHIS define the term ``access'' to
mean actual, physical contact with the agent or the realistic
opportunity for same.
This issue is addressed below in the sections relating to security
risk assessments and security. We are making no change to the
definitions in 7 CFR 331.1 or 9 CFR 121.1 based on this comment.
One commenter stated that 9 CFR 121.1 should define the term
``exotic'' so that the term can be removed from the list of agents.
This issue is addressed below in the section relating to the lists
of VS and overlap select agents and toxins. Therefore, we are making no
change to the definitions in 9 CFR 121.1 in response to this comment.

Purpose and Scope

Interim 7 CFR 331.2 and 9 CFR 121.2 set out the purpose and scope
of the regulations. Specifically, 7 CFR 331.2(a) stated that part 331
sets forth the requirements for possession, use, and transfer of
biological agents or toxins that have been determined to have the
potential to pose a severe threat to plant health or plant products,
while 9 CFR 121.2(a) stated that part 121 sets forth the requirements
for possession, use, and transfer of biological agents or toxins that
have been determined to have the potential to pose a severe threat to
both human and animal health, or to animal health or animal products.
Both sections noted that the purpose of the regulations is to ensure
the safe handling of such agents or toxins, and to protect against the
use of such agents or toxins in domestic or international terrorism or
for any other criminal purpose.
In this final rule, we are amending both sections to clarify that
each part implements the provisions of the Agricultural Bioterrorism
Protection Act of 2002. Furthermore, we are amending 9 CFR 121.2 to
clarify that overlap select agents and toxins are subject to regulation
by both APHIS and CDC.
In interim 7 CFR 331.2 and 9 CFR 121.2, paragraphs (b) and (c)
summarized the regulatory requirements. Since these provisions are
already set forth in other sections of the regulations, we believe it
is unnecessary to summarize them in these sections. Therefore, in this
final rule, we are removing paragraphs (b) and (c) in 7 CFR 331.2 and 9
CFR 121.2, and removing the paragraph designation for paragraph (a) in
both sections since it is no longer necessary.

List of Biological Agents and Toxins

In accordance with the Act, interim 7 CFR 331.3 and 9 CFR 121.3
listed certain biological agents and toxins.
Section 212(a)(2) of the Act requires that the lists of biological
agents and toxins be reviewed and republished biennially, or more often
as needed, and revised as necessary. In addition, the Act requires
that, when determining whether to include an agent or toxin, the
Secretary shall consult with appropriate Federal departments and
agencies and with scientific experts representing appropriate
professional groups.
This final rule serves as APHIS' republication of the lists of
select agents and toxins in 7 CFR 331.3 and 9 CFR 121.3, and in newly
designated 9 CFR 121.4. As part of APHIS' review of the lists of agents
and toxins, we reviewed current scientific information and studies and
consulted with other Federal agencies. We also reviewed and considered
the comments to the December 2002 interim rule on the lists of agents
and toxins.
As previously noted, in this final rule, we are amending the
structure of both parts to be consistent with CDC's select agent
regulations. In 9 CFR part 121, we are creating separate sections for
the lists of VS select agents and toxins and overlap select agents and
toxins--Sec. Sec. 121.3 and 121.4, respectively. We are also adding a
new paragraph (a) to 7 CFR 331.3, containing introductory text, so that
the format of the section is consistent with the format in 9 CFR 121.3
and 9 CFR 121.4.
One commenter recommended that APHIS include in the regulations a
summary of the risk assessment data that supports the listing of each
agent and toxin. The commenter stated that the data will heighten
awareness of the risk characteristics of the listed agents and will
promote safe practice and proficiency in handling such agents.
APHIS does not include risk assessment data in the regulations;
rather, such information is discussed in a rule's preamble. As noted in
the preamble of the August 2002 interim rule, the Act requires APHIS to
consider the following criteria in determining whether to list an agent
or toxin: (1) The effect of exposure to the agent or toxin on animal or
plant health, and on the production and marketability of animal or
plant products; (2) the pathogenicity of the agent or the toxicity of
the toxin and the methods by which the agent or toxin is transferred to
animals or plants; (3) the availability and effectiveness of
pharmacotherapies and prophylaxis to treat and prevent any illness
caused by the agent or toxin; and (4) any other criteria the Secretary
considers appropriate to protect animal or plant health, or animal or
plant products.
We do not believe it is necessary to provide a summary of the risk
assessment data that supports the listing of each select agent or toxin
in order to heighten awareness of the risk characteristics of such
agents and toxins and promote safe practice and proficiency in handling
of such agents and toxins. Information about the risk characteristics
of a select agent or toxin and safe handling practices is available in
scientific literature and other publications (e.g., the CDC/NIH
publication, ``Biosafety in Microbiological and Biomedical
Laboratories''). For these reasons, we are making no change based on
this comment.
Interim 7 CFR 331.3(a) (newly designated Sec. 331.3(b)) listed the
biological agents and toxins that have been determined to pose a severe
threat to plant health or to plant products (PPQ select agents and
toxins).
In this final rule, we are removing Phakopsora pachyrhizi, also
known as Asian soybean rust, from the list of PPQ select agents and
toxins. Asian soybean rust has been introduced into the United States
by natural means and now it would have virtually no impact if used as a
weapon of terrorism. Asian soybean rust was detected in the United
States in November 2004. All available evidence suggests that spores
were blown into the United States during a series of hurricanes in
2004. Detection surveys indicate that it is present in at least nine
southeastern States; however, USDA is conducting additional surveys to
determine the full extent of the introduction. Because Asian soybean
rust has a host range of more than 90 plant species and its spores
disperse naturally on wind currents, this disease will continue to
spread naturally and it cannot be controlled effectively. We expect
that this disease will quickly reach the full extent of its ecological
range in the United States. As a result, there is an urgent need for
timely research on effective means to manage the disease in the United
States. For all of these reasons, we are removing Phakopsora pachyrhizi
from the list of PPQ select agents and toxins. However, we note that a
permit will still be required for importation or interstate movement of
Asian soybean rust (7 CFR part 330).
A commenter claimed that, pursuant to the rules of the
International Code of Nomenclature of Bacteria, two bacteria

[[Page 13249]]

have been renamed; thus, Liberobacter africanus should be Candidatus
Liberobacter africanus, and Liberobacter asiaticus should be Candidatus
Liberobacter asiaticus.
We agree. Therefore, in this final rule, we are replacing the entry
for Liberobacter africanus with Candidatus Liberobacter africanus and
replacing Liberobacter asiaticus with Candidatus Liberobacter
asiaticus. In addition, we are placing Candidatus Liberobacter
africanus and Candidatus Liberobacter asiaticus on separate lines in
order to make it clear that each one is a select agent.
One commenter argued that plum pox potyvirus should not be listed
as a select agent because it is only naturally transmitted by aphids,
and, without the insect vector to transmit the disease from one plant
to another, the possibility of the virus being used as a weapon of
terrorism is extremely small. The commenter stated that laboratory
research of this agent, in the absence of its natural vector and only
known means of transmission, poses little to no risk to plant health or
plant products.
We agree that plum pox potyvirus (PPV) has limited potential as a
weapon of terrorism given its biological characteristics. PPV is not
easily transmitted and does not spread easily. The natural host range
is limited to plants in the genus Prunus (e.g., plums and other stone
fruits). The natural spread of the disease requires insect vectors
(aphids), and is a complex biological process, and artificial spread
requires grafting, which is labor intensive and time-consuming. PPV is
not spread by pollen or seed. While systemic treatments are not
completely effective at mitigating the disease, destruction of infected
trees mitigates the effects of the disease, removal of the diseased
trees and other susceptible hosts removes the source of infection, and
transmission can be halted by removing host material from the area.
Furthermore, most strains of PPV attack only a few varieties of stone
fruits, which limits the affect of an outbreak on the production and
marketability of stone fruits. For these reasons, in this final rule,
we are removing plum pox potyvirus from the list of PPQ select agents
and toxins. However, we note that PPV continues to be a quarantine pest
under the domestic plant regulations (7 CFR 301.74 through 301.74-5).
Another commenter asserted that Ralstonia solanacearum, race 3,
biovar 2, should not be listed as a select agent. This commenter stated
that the bacterium is unlikely to become established in the northern
United States, where potatoes are commercially grown, because it is
intolerant of freezing and does not generally survive winters in
regions with sustained temperatures below 20 [deg]F. The commenter
claimed that, even if the bacterium became established, it is unlikely
to cause an economically damaging disease outbreak in the climactic
conditions characteristic of North America. The commenter went on to
note that the bacterium has been repeatedly introduced into the United
States without impact.
APHIS has determined that Ralstonia solanacearum, race 3, biovar 2,
has the potential to pose a severe threat to plant health or plant
products. The bacterium is known to attack a number of economically
significant hosts (e.g., geraniums and tomatoes), not just potatoes.
Some of the known hosts are grown in greenhouses (e.g., geraniums),
which protect them from local climatic conditions, and some hosts are
grown in fields throughout the United States (e.g., tomatoes and
potatoes). With regard to potatoes, scientific data indicate the
potential range of the bacterium would include the potato-growing
regions in the United States. Ralstonia solanacearum, race 3, biovar 2,
occurs in Europe as far north as the 56th parallel (southern
Scandinavia), which parallels regions of Canada. Furthermore, there are
a number of wild hosts that would contribute to the spread of the
bacterium if it were introduced into the United States. For these
reasons, we are making no changes based on this comment.
Interim 9 CFR 121.3(d) (newly designated Sec. 121.3(b)) listed the
biological agents and toxins that have been determined to have the
potential to pose a severe threat to animal health or to animal
products (VS select agents and toxins).
A commenter asserted that listing Japanese encephalitis virus (JEV)
as a select agent will negatively impact research on this disease, as
well as on West Nile virus and dengue virus. This commenter stated that
there does not appear to be sufficient justification for making
Japanese encephalitis virus a select agent.
We disagree that there is insufficient justification for listing
Japanese encephalitis virus as a VS select agent. The virus can cause
severe disease in horses and swine for which there is no effective
treatment and no domestically available veterinary vaccine. While the
select agent regulations may affect research on JEV, we expect it will
have a negligible effect on associated research on West Nile virus and
dengue virus. For these reasons, we are making no change in response to
this comment.
Several commenters questioned the inclusion of malignant catarrhal
fever virus (exotic) on the list of select agents. One commenter stated
the disease malignant catarrhal fever virus is caused be a variety of
herpes viruses, none of which is known as malignant catarrhal fever
virus. The commenter stated that Alcelaphine herpesvirus type 1 infects
most wildebeest and spreads to domestic cattle causing malignant
catarrhal fever in Africa. The commenter argued that malignant
catarrhal fever virus (exotic) should be replaced with Alcelaphine
herpesvirus type 1. Another commenter argued that the biological
features of malignant catarrhal fever viruses prevent them from being
effective bioterror agents. The commenter noted that Alcelaphine
herpesvirus type 1 can only be transmitted by parenteral injection and
cow-to-cow transmission does not occur under natural conditions. This
commenter also argued that it is misleading to label malignant
catarrhal fever as ``exotic'' since it is present wherever there are
wildebeests, from zoos to exotic game farms.
We agree that clarification is needed with regard to the term
malignant catarrhal fever virus. Accordingly, in this final rule we are
replacing the entry for malignant catarrhal fever virus with malignant
catarrhal fever virus (Alcelaphine herpesevirus type 1). However, we
disagree that the biological features of malignant catarrhal fever
viruses prevent them from being effective bioterror agents. Malignant
catarrhal fever virus (Alcelaphine herpesevirus type 1) causes severe
disease in cattle, and it may be possible for the virus to be
transmitted from cow to cow. Currently, this virus is not found in U.S.
cattle populations, and a widespread outbreak of the disease would
likely result in widespread animal movement restrictions that could be
long term, at least with respect to exports. We are making no change in
response to this comment.
One commenter suggested that Newcastle disease virus (VVND) be
replaced with Newcastle disease virus (velogenic). The commenter stated
the background information indicated that only velogenic strains are to
be regulated; however, the acronym VVND indicates viscerotropic,
velogenic Newcastle disease.
In the December 2002 interim rule, we replaced the entry for
Newcastle disease virus (exotic) with Newcastle disease virus (VVND) to
make it clear that we are regulating only velogenic strains.
Viscerotropic, velogenic Newcastle

[[Page 13250]]

disease (VVND) is a velogenic strain. To ensure that we are regulating
all of the velogenic strains, in this final rule we are replacing the
entry for Newcastle disease virus (VVND) with Newcastle disease virus
(velogenic).
A commenter stated the distinction between domestic and exotic
vesicular stomatitis virus cannot be justified scientifically.
Therefore, it would be more logical to list all vesicular stomatitis
viruses except specific viruses that are generally recognized as
attenuated (e.g., the VSV-Indiana Lab strain).
We do not believe it is necessary to regulate all strains of
vesicular stomatitis virus, especially those strains that have limited
morbidity and mortality in the United States. Therefore, we are making
no change based on this comment.
Interim 9 CFR 121.3(b) (newly designated Sec. 121.4(b)) listed the
biological agents and toxins that have been determined to have the
potential to pose a severe threat to both human and animal health, to
animal health, or to animal products (overlap select agents and
toxins).
Several commenters pointed out that Clostridium botulinum is listed
in the APHIS regulations but not in the CDC regulations.
APHIS inadvertently listed both Clostridium botulinum and Botulinum
neurotoxin producing species of Clostridium as overlap agents in the
December 2002 interim rule. We always intended to only list Botulinum
neurotoxin producing species of Clostridium in order to be consistent
with CDC. Accordingly, we are removing Clostridium botulinum from the
list of overlap select agents and toxins in this final rule.
A number of commenters argued that overlap agents that are endemic,
widespread, and easily isolated from natural sources should not be
included in the list of overlap select agents. For these reasons, one
commenter recommended that Francisella tularensis and Coxiella burnetii
be removed from the list of overlap agents. Several commenters stated
that Coccidioides immitis should not be included in the list of overlap
select agents because it is endemic in California's Central Valley and
is found in many areas of the southwest. Another commenter argued that
Coxiella burnetii should be removed from the overlap list because ``it
is so ubiquitous in nature that its identification as a select agent is
meaningless.'' One commenter argued that Eastern equine encephalitis
virus should be removed from the overlap list because it is endemic and
even if it were intentionally introduced into people, horses, or other
domestic animals, there would be little or no chance of spread to cause
an adverse agricultural event.
We agree that Coxiella burnetii, Coccidioides immitis, and
Francisella tularensis are endemic, widespread, and easily isolated
from natural sources. However, these factors are not sufficient reason
to remove these agents from the list of overlap select agents and
toxins. Furthermore, we disagree that there is little risk of an
adverse agricultural event involving Eastern equine encephalitis virus
because it can cause high mortality in horses, and there is no
mandatory vaccination program in the United States. We are making no
changes based on this comment.
A commenter stated that it is pointless to regulate trichothecenes
such as T-2 toxin as select agents if highly toxigenic strains of the

toxin-producing organism are not also regulated.
We are regulating T-2 toxin, and not the organism that produces it,
because we believe the toxin has the potential to pose a severe threat
to public health and safety, to animal health, and to animal products.
Accordingly, we are making no change in response to this comment.
Interim 7 CFR 331.3(c)(2), 9 CFR 121.3(c), and 9 CFR 121.3(f)(2)
(newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR 121.4) set out
the provisions for genetic elements.
One commenter stated there are differences between the APHIS and
CDC regulations regarding genetic elements. For example, the
regulations seem to imply that no bacterial sequences are regulated,
except those from animal agents.
We agree. In the interim regulations, CDC provided that infectious
viral sequences of HHS and overlap select agents are regulated, while
APHIS provided that infectious viral sequences of overlap agents are
regulated and infectious viral and bacterial sequences of PPQ and VS
select agents are regulated. To resolve these differences, in this
final rule we are adopting CDC's approach for genetic elements.
Specifically, newly designated 7 CFR 331.3, 9 CFR 121.3, and 9 CFR
121.4 provide that the following will be considered select agents and
toxins:
Nucleic acids that can produce infectious forms of any of
the select agent viruses listed in either 7 CFR part 331 or 9 CFR part
121;
Recombinant nucleic acids that encode for the functional
forms of any toxin listed in either 7 CFR part 331 or 9 CFR part 121 if
the nucleic acids: (1) Can be expressed in vivo or in vitro; or (2) are
in a vector or recombinant host genome and can be expressed in vivo or
in vitro; and
Select agents and toxins listed in either 7 CFR part 331
or 9 CFR part 121 that have been genetically modified.
Another commenter stated that interim 9 CFR 121.3(c) and 121.3(f)
conflict--Sec. 121.3(c) seems to include fragments, while Sec.
121.3(f) exempts them. The commenter pointed out that all genetic
elements that cause disease can be fragmented into pieces that cannot
cause disease, but that can be reconstituted simply and quickly.
We believe the changes in this final rule will address the
differences identified by this commenter. Accordingly, we are making no
change based on this comment. However, we note that fragments are not
subject to the regulations until reconstituted.
One commenter asked if cDNA is regulated. This commenter also asked
how sequence data of select agents will be protected, since it can be
used to make a select agent.
A cDNA fragment will be subject to the regulations if it can
produce either an infectious form of toxin or a select agent. Sequence
data of select agents is already in the public domain, and APHIS cannot
protect this information. However, we note that an individual or entity
that uses sequence data to produce an infectious agent or toxin will be
subject to the select agent regulations. We are making no changes based
on this comment.
Interim 7 CFR 331.3(b) and 9 CFR 121.3(e) stated that any
biological agent or toxin that is in its naturally occurring
environment will not be subject to the requirements of either part,
provided that the biological agent or toxin has not been intentionally
introduced, cultivated, collected, or otherwise extracted from its
natural source.
To be consistent with CDC, we are adopting the phrase ``excluded
from the requirements of this part'' in place of the phrase ``will not
be subject to the requirements of this part.'' Thus, in this final
rule, newly designated 7 CFR 331.3(d)(1), 9 CFR 121.3(d)(1), and 9 CFR
121.4(d)(1) state that a select agent or toxin that is in its naturally
occurring environment is excluded from the requirements of the
regulations, provided that the agent or toxin has not been
intentionally introduced, cultivated, collected, or otherwise extracted
from its natural source.
One commenter stated that the naturally occurring environment of a
virus is its host. The commenter pointed out that Coxiella burnetii can
be found in milk samples and asked if the truck moving milk to a
processing plant would be subject to the regulations or if

[[Page 13251]]

the milk sample submitted to a laboratory for mastitis testing would be
subject to the regulations as the milk sample is being collected.
Coxiella burnetii that is contained in milk in a truck or in a
diagnostic sample is considered to be in its naturally occurring
environment as long as it has not been intentionally introduced,
cultivated, collected, or otherwise extracted from its natural source.
We are making no changes in response to these comments.
Another commenter stated that the regulations suggest that an agent
found in the lymph node of a slaughtered animal (found on
histopathology but not cultivated or extracted) is in its naturally
occurring environment and, therefore, exempt from notification.
This comment appears to combine the requirements for exclusions and
exemptions. A select agent or toxin that has not been intentionally
introduced, cultivated, collected, or otherwise extracted from its
natural source is considered to be in its naturally occurring
environment and, therefore, excluded from the requirements of the
regulations. The exemption provisions for overlap select agents and
toxins are set forth in newly designated 9 CFR 121.6. Histopathology
alone is not a definitive identification of a select agent. However, a
select agent that has been identified by a histopathology method that
has been validated would need to be reported to APHIS or CDC in
accordance with the regulations. We are making no changes in response
to this comment.
A commenter stated that any naturally occurring organism expressing
a Shigatoxin should be specifically excluded from the list of select
agents and toxins.
As previously noted, we are regulating the toxin and not the
organisms that produce the toxin. Therefore, it is not necessary to
exclude from the requirements of the regulations any naturally
occurring organism expressing a Shigatoxin. However, we note that
Shigatoxin under the control of a principal investigator, treating
physician or veterinarian, or commercial manufacturer or distributor is
excluded from the requirements of 9 CFR part 121 if the aggregate
amount does not, at any time, exceed 100 mg (newly designated 9 CFR
121.4(d)(3)).
Interim 7 CFR 331.3(c)(1) (newly designated 7 CFR 331.3(d)(2))
provided that nonviable agents that are, bear, or contain listed agents
or toxins will not be subject to the requirements of the part because
they do not have the potential to pose a severe threat to plant health
or plant products. Similarly, interim 9 CFR 121.3(f) (newly designated
9 CFR 121.3(d)(2) and 121.4(d)(2)) provided that nonviable agents or
fixed tissues that are, bear, or contain listed agents or toxins will
not be subject to the requirements of the part because they do not have
the potential to pose a severe threat to both human and animal health,
or to animal health or animal products.
In this final rule, we are amending both sections to clarify that
these provisions apply to nonviable agents and nonfunctional toxins.
These changes will make the provisions in the APHIS and CDC regulations
consistent.
A commenter requested clarification of the terms ``nonviable'' and
``nonfunctional'' select agents or toxins. The commenter noted that
some organisms can survive in nature, others only under lab conditions,
and others not under any conditions.
A nonviable agent is not capable of replicating, infecting a plant
or animal, or causing disease, while a nonfunctional toxin is not able
to produce a toxic effect. These terms are generally understood in the
scientific community, and we do not believe that further clarification
is needed in the regulations. Therefore, we are making no change in
response to this comment.
Footnotes in interim 9 CFR 121.3 stated that the importation and
interstate movement of nonviable agents and genetic elements are
subject to the permit requirements under 9 CFR part 122.
One commenter asked why a permit is needed for nonviable agents and
genetic elements that are excluded from regulation under 9 CFR part
121. The commenter argued that nonviable agents and genetic elements
that are not capable of causing disease do not meet the definition of
``organism'' in part 122. Another commenter requested clarification of
the permit requirement for nonviable agents or fixed tissues. The
commenter stated that the provision seems to suggest that, for as long
as you retain the tissues, you would need to get yearly interstate
transport permits even though no further receipt/transport is taking
place.
The regulations in 9 CFR part 122 pertain to the movement of
organisms and vectors. A nonviable agent or genetic material could
serve as a vector of a disease agent through ineffective or
insufficient processing methods, and, therefore, require a permit for
importation or interstate movement. However, since a permit may not
always be required, in this final rule we are revising the footnotes so
that, in newly designated 9 CFR 121.3 and 121.4, they state that a
permit may be needed for nonviable agents and genetic elements. We note
that permits may contain restrictions that extend beyond the expiration
of the permit if the agent/genetic element is not destroyed. If so, an
individual or entity would be required to obtain a new permit as long
as the nonviable agent or genetic element is possessed by the
permittee.
A commenter asked if a positive chain reaction (PCR) test done on
formalin fixed tissue that detects Eastern equine encephalitis virus
would be exempt because it is nonviable.
This comment is not entirely clear. We believe the commenter is
asking about the reporting requirements for identifications of a select
agent or toxin. If Eastern equine encephalitis virus is identified from
formalin tissue, an individual or entity must report the identification
to APHIS in accordance with either newly designated 9 CFR 121.6 or
121.9, whichever is applicable. However, nonviable overlap select
agents or nonfunctional toxins are excluded from the regulations (newly
designated 9 CFR 121.4(d)(2)). We are making no changes in response to
this comment.
Interim 9 CFR 121.3(f)(3) provided an exclusion from the
regulations for ``[o]verlap toxins under the control of a principal
investigator (or equivalent), if the total aggregate amount does not,
at any time, exceed the following amounts: 0.5 mg of Botulinum
neurotoxins (types A-G), 100 mg of Clostridium perfringens epsilon
toxin, 100 mg of Shigatoxin, 5 mg of Staphylococcal enterotoxins, and
1,000 mg of T-2 toxin.
APHIS and CDC have determined that this exclusion is too narrow and
has the unintended consequence of requiring treating physicians or
veterinarians and commercial manufacturers or distributors that
possess, use, or transfer otherwise excluded toxins to register.
Accordingly, in this final rule, we are broadening the scope of the
overlap toxin exclusion to cover overlap toxins under the control of a
principal investigator, treating physician or veterinarian, or
commercial manufacturer or distributor (newly designated Sec.
121.4(d)(3)). To be consistent with CDC, we are also removing the words
``(types A-G)'' after Botulinum neurotoxins.
One commenter requested that APHIS clarify that there is no limit
to the amount of overlap toxins an individual or entity may possess or
use, as long as the amount of toxin under the control of each principal
investigator does not exceed the specified amounts.
We believe that newly designated Sec. 121.4(d)(3) clearly
indicates that the exclusion is based upon the amount of

[[Page 13252]]

overlap toxin under the control of a principal investigator, treating
physician or veterinarian, or commercial manufacturer or distributor.
Therefore, we are making no change based on this comment.
Another commenter asked if the toxin amounts refer to quantities of
isolated toxin (i.e., toxin that has been extracted and is separate
from the cell) or toxin that is in the process of being produced by
living cells and may increase in quantity. The commenter stated that
measuring the exact quantities of a toxin can only reasonably be
achieved if the toxin has been isolated from the cell.
We agree that an exact measurement of a toxin can only reasonably
be achieved if the toxin has been isolated from the cell. The amounts
listed in newly designated Sec. 121.4(d)(3) refer to the amount of
toxin that has been isolated from the cell, not the amount of toxin
that is being produced in living cells. We are making no change based
on this comment.
Interim 9 CFR 121.3(g) (newly designated Sec. Sec. 121.3(e) and
121.4(e)) provided a procedure by which an individual or entity may
request a determination by the Administrator that an attenuated strain
of a biological agent does not pose a severe threat to both human and
animal health, or to animal health or animal products.
In this final rule, we are adding this provision to 7 CFR 331.3 so
that the regulations in part 331 are consistent with the regulations in
9 CFR part 121. We are also amending both parts to clarify the
requirements and streamline the process for excluding an attenuated
strain of a select agent or toxin. Specifically, paragraph (e) in 7 CFR
331.3, 9 CFR 121.3, and 9 CFR 121.4 provides that an individual or
entity may apply for an exclusion by submitting a written request and
supporting scientific information. A written decision granting or
denying the request will be issued and the exclusion will be effective
upon notification of the applicant. Exclusions will be published
periodically in the notice section of the Federal Register and will be
listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
Paragraph (e) also provides that, if an

excluded attenuated strain is subjected to any manipulation that
restores or enhances its virulence, the resulting select agent or toxin
will be subject to the requirements of each part. This has always been
the way the exclusion for attenuated strains has been interpreted;
however, we are adding this provision to both parts to facilitate
compliance.
One commenter claimed that the microbiological community, not just
government agency representatives, must be involved in the process for
excluding attenuated strains. The commenter recommended the
establishment of a broadly representative group to act as an advisory
body to APHIS and CDC. This commenter also stated that the regulations
should state that determinations regarding overlap agents require the
concurrence of APHIS and CDC.
APHIS may exclude attenuated strains of select agents or toxins
after consultation with subject matter experts, including those in the
microbiology community. For overlap select agents and toxins, APHIS may
exclude attenuated strains after consultation with subject matter
experts and CDC. We do not believe it is necessary to include these
administrative procedures in the regulations. Accordingly, we are
making no change based on this comment.
A commenter stated that APHIS should specify the criteria for
exclusion of attenuated strains because the current standard (``poses a
severe threat'') is insufficiently specific.
The Act requires APHIS to regulate the possession, use, and
transfer of biological agents and toxins that have been determined to
pose a severe threat to public health and safety, to animal health, to
plant health, or to animal or plant products. Thus, the Act establishes
the standard by which APHIS may exclude an attenuated strain (i.e., the
strain does not pose a severe threat). We are making no change to the
regulations in response to this comment.
A commenter asserted that the excluded attenuated strains should be
listed in the regulations so that an entity may be able to determine if
an agent is excluded before registering the strain and installing any
additional security.
APHIS is not including the lists of excluded attenuated strains of
select agents or toxins in the regulations because any change to the
lists of exclusions would require rulemaking. To minimize the potential
delays related to rulemaking, in this final rule we are providing that
exclusions will be published periodically in the notices section of the
Federal Register and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html.
We believe

these measures will provide sufficient notice to the public.
A commenter stated that the exclusion for attenuated strains would
not make agents such as the Sterne strain of Bacillus anthracis and the
vaccine strain of Brucella abortus available for the critical need of
quality control, without registration of the laboratory.
An attenuated strain of a select agent may be excluded from the
requirements of regulations based upon a determination that the
attenuated strain does not pose a severe threat to plant health or
plant products (newly designated 7 CFR 331.3(e)) or to public health
and safety, to animal health, or animal products (newly designated 9
CFR 121.3(e) and 121.4(e)). Once an attenuated strain of a select agent
has been excluded, it may be used for quality control or for other
purposes, as long as its virulence is not restored or enhanced. To
date, a number of attenuated strains have been excluded, including
Bacillus anthracis Sterne, pX01+pX02- and
Brucella abortus strain RB51 (vaccine strain). For these reasons, we
are making no change in response to this comment.
One commenter asked if the TC-83 vaccine strain of Venezuelan
equine encephalitis is subject to the regulations. The commenter
pointed out that the CDC regulations specifically exclude this strain
from regulation but the APHIS regulations do not.
Both APHIS and CDC have excluded the TC-83 vaccine strain of
Venezuelan equine encephalitis virus from the requirements of the
regulations. We note that a current list of exclusions is available on
the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html.
We are making no change based on this comment.

To address concerns raised by Federal law enforcement agencies
related to seizures (i.e., possession) of select agents or toxins, in
this final rule we are adding a new paragraph (f) to 7 CFR 331.3, 9 CFR
121.3, and 9 CFR 121.4 to address situations in which the select agents
or toxins have been identified prior to seizure. In the event that a
Federal law enforcement agency seizes a suspected select agent or toxin
or unknown material, this material will be regarded as a specimen
presented for diagnosis or verification and, therefore, will not be
subject to the regulations until it has been identified as a select
agent or toxin.
Paragraph (f) provides that any select agent or toxin seized by a
Federal law enforcement agency will be excluded from the requirements
of the regulations during the period between seizure of the agent or
toxin and the transfer or destruction of such agent or toxin provided
that:
As soon as practicable, the Federal law enforcement agency
transfers the

[[Page 13253]]

seized agent or toxin to an entity eligible to receive such agent or
toxin or destroys the agent or toxin by a recognized sterilization or
inactivation process;
The Federal law enforcement agency safeguards and secures
the seized agent or toxin against theft, loss, or release and reports
any theft, loss, or release of such agent or toxin; and
The Federal law enforcement agency reports the seizure of
the select agent or toxin to APHIS or CDC.
This provision will allow Federal law enforcement agencies to
conduct certain law enforcement activities (e.g., collecting evidence
from a laboratory crime scene) without being in violation of the
regulations. We note, however, that this provision does not authorize
the seizure of a select agent or toxin by a Federal law enforcement
agency; rather, it establishes the conditions under which a Federal law
enforcement agency may seize a select agent or toxin without violating
the regulations. Seizure of a select agent or toxin by a Federal law
enforcement agency would have to be in accord with that agency's
statutory authority.

Exemptions

Interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 (newly designated
7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6) set out exemptions.
Interim 9 CFR 121.4(a) provided that clinical or diagnostic
laboratories and other entities possessing, using, or transferring
overlap agents or toxins that are contained in specimens presented for
diagnosis or verification will be exempt from the requirements of part
121, provided that the identification of such agents or toxins is
immediately reported to APHIS or CDC, and to other appropriate
authorities when required by Federal, State, or local law; and, within
7 days after identification, such agents or toxins are transferred or
inactivated, and APHIS Form 2040 is submitted to APHIS or CDC. Interim
7 CFR 331.4(a) and 9 CFR 121.5(a) contained similar exemption
provisions for diagnostic laboratories (the term clinical laboratories
is not applicable to the plant-related regulations in 7 CFR part 331 or
the animal-related regulations in 9 CFR part 121). Exemption provisions
for laboratories and other entities that perform proficiency testing
were set out in interim 9 CFR 121.4(b) and 121.5(b).
In this final rule, we are amending both parts to clarify the
exemption provisions related to clinical or diagnostic laboratories and
other entities (for overlap select agents and toxins) and diagnostic
laboratories and other entities (for PPQ and VS select agents and
toxins). Specifically, paragraph (a) in newly designated 7 CFR 331.5
and paragraphs (a) and (b) in newly designated 9 CFR 121.5 and 121.6
make clear that laboratories and other entities must meet the exemption
requirements for each select agent or toxin contained in a specimen
that it possesses, uses, or transfers. This change takes into account
situations in which a diagnostic laboratory or other entity could be
registered for a select agent or toxin but still meet the exemption
requirements for other select agents or toxins contained in specimens.
We are also amending both parts to clarify that, as a condition of
exemption, clinical or diagnostic laboratories and other entities must
transfer a select agent or toxin in accordance with the transfer
requirements in each part (newly designated 7 CFR 331.16 and 9 CFR
121.16, respectively) or destroy the agent or toxin on-site by a
recognized sterilization or inactivation process.
In this final rule, we are also deleting in both parts the
requirement that the identification of a select agent or toxin be
reported to appropriate authorities when required by Federal, State, or
local law (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5). Because
this provision merely indicates that additional reporting requirements
may exist under Federal, State, or local law, it is not necessary to
include this provision in the regulations. It is the entity's
responsibility to be familiar with all legal requirements for select
agents and toxins.
In addition, newly designated 9 CFR 121.5 and 121.6 require
immediate reporting after identification for specified select agents
and toxins; identification of the other select agents and toxins must
be reported within 7 calendar days after identification. This change
will reduce the reporting burden on the public while continuing to
provide information that will help us to identify outbreaks and to
monitor activities related to select agents and toxins.
Finally, we are deleting footnote 1 in interim 7 CFR 331.4 (newly
designated 7 CFR 331.5) because this information is contained in the
transfer section in this final rule (newly designated Sec. 331.16). We
are also deleting the application and contact information contained in
footnotes in interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5 because
addresses and telephone numbers are subject to change. Information
about the submission of forms, notices, and requests for exemptions or
exclusions is available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html
.

A commenter asserted that clinical or diagnostic laboratories
should be required to secure the agent or toxin prior to transfer or
destruction.
We agree. Taking into account the risks posed by select agents and
toxins and the security requirements for registered entities, it is
reasonable to require that a clinical or diagnostic laboratory or other
entity secure the agent or toxin prior to transfer or destruction.
Furthermore, we believe it is reasonable to require that a clinical or
diagnostic laboratory or other entity report any theft, loss, or
release of a select agent or toxin prior to transfer or destruction.
Therefore, newly designated 7 CFR 331.5, 9 CFR 121.5, and 9 CFR 121.6
require, as another condition of exemption, that the select agent or
toxin be secured against theft, loss, or release during the period
between identification of the agent or toxin and transfer or
destruction of such agent or toxin, and that any theft, loss, or
release of such agent or toxin be reported.
Another commenter argued that the exemptions for clinical and
diagnostic laboratories should require, at the very least, that
employees of such labs be subject to security risk assessments by the
Attorney General.
The Act does not require security risk assessments for employees of
entities that are exempt from registration under the regulations
(section 212(e)). We believe that the conditions for exemption in this
final rule provide adequate safeguard and security measures to protect
animal and plant health, and animal and plant products. Accordingly, we
are making no change based on this comment.
One commenter requested that APHIS define the term
``identification.'' The commenter asked if a PCR positive reaction
constituted identification or simply detection. This commenter also
wondered if an entity must report an identification done on a nonviable
organism.
If a PCR test is recognized in the scientific community as an
identification method, then a result utilizing this test must be
reported. If not, reporting is not required. An individual or entity
must report an identification done on a nonviable organism in
accordance with the regulations. We require this reporting in order to
obtain surveillance information about select agents or toxins. We are
making no changes in response to this comment.
Several commenters argued that the requirement to transfer an agent
or toxin

[[Page 13254]]

within 7 calendar days of identification was unrealistic. One commenter
stated that delays in transfer approval by APHIS or CDC could result in
delays in shipping the samples. Several commenters expressed concern
about this deadline due to the unreliability of shippers. Another
commenter stated that it is unreasonable and counterproductive to
require diagnostic labs to destroy or transfer select agents within 7
days after identification. The commenter said that some labs may
process hundreds or thousands of samples each week and generate large
numbers of select agent isolates, and transferring these isolates to a
qualified lab within 1 week will be very difficult and costly. The
commenter claimed that most labs will simply destroy the isolates and
that such destruction will result in the loss of valuable scientific
material.
Based on information provided by CDC and APHIS' National Veterinary
Services Laboratories (NVSL), and taking into consideration the risks
posed by select agents and toxins, we believe that 7 days will provide
ample time after identification to destroy the agent or toxin, or to
make transfer arrangements and to transfer the agent or toxin. However,
in this final rule, we are amending newly designated 7 CFR 331.5(a) and
9 CFR 121.5(a) to allow the Administrator to make exceptions to these
timeframes, as necessary. We are also amending newly designated 9 CFR
121.6(a) to allow the Administrator or the HHS Secretary to make
exceptions to these timeframes for overlap select agents or toxins, as
necessary. Finally, we are making similar changes to newly designated 9
CFR 121.5(b) and 9 CFR 121.6(b) to allow for exceptions to the
timeframes for proficiency testing, which require that an agent or
toxin be transferred or destroyed within 90 calendar days of receipt.
Another commenter recommended a longer holding period for agents
and toxins before mandatory inactivation--30 to 45 days instead of 7
days--because the destruction of isolates of select agents after only 7
days is counter to good quality control in labs, which often specifies
that isolates and specimens be kept for 30 days, and labs often have
cases pending for at least 30 days awaiting additional results. The
commenter went on to note that it is good lab practice to maintain the
original sample until a case is complete, and labs often maintain
samples so that additional testing can be done as needed.
The exemption provisions in interim 7 CFR 331.4(a), 9 CFR 121.4(a),
and 9 CFR 121.5(a) (newly designated 7 CFR 331.5(a), 9 CFR 121.5(a),
and 9 CFR 121.6(a)) do not require mandatory inactivation of a select
agent or toxin. To qualify for an exemption, an individual or entity
must satisfy the conditions for exemption, including transferring or
destroying the select agent or toxin within 7 calendar days of
identification unless directed otherwise by the Administrator or HHS
Secretary. However, an individual or entity could continue to hold a
select agent or toxin if it registers with APHIS or, for overlap select
agents and toxins, if it registers with APHIS and CDC. While we
recognize that the select agent regulations may have an effect on
internal quality assurance procedures, lengthening the time that a
diagnostic laboratory or other entity can possess a sample without
being registered is inconsistent with the intent of the Act. We are
making no changes based on this comment.
One commenter asked if diagnostic facilities could preregister for
potential isolates they might obtain from future diagnostic cases. The
commenter stated the regulations suggest that a facility has to have
the agent before it can register. The commenter stated that, once an
agent is isolated, it appears that the facility would only have 7 days
to become registered before it would have to destroy or transfer the
agent. The commenter noted that even the process to amend a certificate
of registration would likely take longer than 7 days.
The regulations do not preclude preregistration for a select agent
or toxin. A certificate of registration may be issued to an entity as
long as the entity meets the regulatory requirements for such agent or
toxin, even if the entity does not currently possess that particular
agent or toxin.
The regulations (interim 7 CFR 331.4(b) and 9 CFR 121.5(f); newly
designated 7 CFR 331.5(b) and 9 CFR 121.5(f)) provide that the
Administrator may grant exemptions from the requirements of 7 CFR part
331 and 9 CFR part 121 upon a showing of good cause and a determination
that such an exemption is consistent with protecting animal or plant
health or animal or plant products.
A commenter stated that APHIS should establish timelines for
responding to requests for exemptions. APHIS is committed to processing
requests for exemptions in a timely manner. We do not believe it is
necessary to include in the regulations timelines for responding to
requests for exemptions. Therefore, we are making no change based on
this comment.
Interim 9 CFR 121.4(c) and 121.5(d) provided that, unless the
Administrator by order determines that additional regulation is
necessary to protect animal health, or animal products, an individual
or entity possessing, using, or transferring products that are, bear,
or contain agents or toxins will be exempt from the requirements of
this part if the products have been cleared, approved, licensed, or
registered pursuant to:
(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et
seq.);
(2) Section 351 of the Public Health Service Act (42 U.S.C. 262);
(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7
U.S.C. 131 et seq.).
In this final rule, newly designated Sec. Sec. 121.5(d) and
121.6(c) clarify that the product is exempt from the requirements of
the regulations. This change is designed to address those situations in
which an entity produces an exempt product but conducts other
activities that would require registration under this part.
A commenter requested that APHIS and CDC provide a list of agents
exempted under the Federal laws listed in interim 9 CFR 121.4(c) so
that investigators would know if the agents they possess or wish to
study are exempt.
It is not administratively feasible for APHIS to maintain a list of
select agents exempted under the Federal laws described above. The
regulations provide sufficient information for an individual or entity
to determine if the agents they possess or wish to study are exempt.
Accordingly, we are making no changes based on this comment.
In interim 9 CFR 121.5(c), we provided that an individual or entity
receiving diagnostic reagents and vaccines that are, bear, or contain
select agents or toxins that are produced at USDA diagnostic facilities
will be exempt from the requirements of part 121.
A commenter stated that agents approved by APHIS' Center for
Veterinary Biologics for use in USDA licensed facilities should be
exempt from the requirements of the rule.
We disagree. We included this provision in the regulations in order
to exempt products, not agents, that would be cleared, approved,
licensed, or registered pursuant to the Virus-Serum-Toxin Act (21
U.S.C. 151-159), but for the fact that they are produced by USDA. In
order to clarify that this exemption applies to products, in this final
rule, newly designated 9 CFR 121.5(c) provides that diagnostic reagents
and vaccines that are, bear, or contain VS select agents or toxins that

[[Page 13255]]

are produced at USDA diagnostic facilities will be exempt from the
requirements of this part.
The regulations (interim 9 CFR 121.4(e); newly designated Sec.
121.6(e)) provide that the Administrator may exempt an individual or
entity from the requirements of the part for 30 days if it is necessary
to respond to a domestic or foreign agricultural emergency involving an
overlap agent or toxin. This exemption may be extended for an
additional 30 days.
One commenter argued that the 30-day special exemption granted
during an emergency is insufficient to deal with a foreign animal or
outbreak emergency. This commenter stated that neither exotic Newcastle
disease or the low pathogenic avian influenza outbreaks were resolved
in 60 days.
Section 212(g)(1)(D) of the Act sets forth the exemption for
agricultural emergencies involving overlap select agents and toxins.
The Act specifies that such exemptions may not exceed 60 days.
Accordingly, we are making no changes based on this comment.

Registration

Interim 7 CFR 331.5, 331.6, and 331.8 and 9 CFR 121.6, 121.7, and
121.9 (newly designated 7 CFR 331.7 and 9 CFR 121.7) set out
registration requirements and procedures.
One commenter stated that the regulations do not contemplate or
address a situation where an entity has employees that possess, use, or
transfer select agents at locations owned and controlled by another
entity. The commenter stated that it is a nonprofit organization that
provides medical research personnel to Federal agencies. The commenter
asserted that the regulations and the registration application should
be revised to require registration for the entity that owns or controls
the location where agents and toxins are used and stored.
This final rule requires that, unless exempted under the
regulations, an individual or entity that possesses, uses, or transfers
select agents or toxins must register with APHIS or, for overlap select
agents or toxins, APHIS and CDC. The regulations provide for both
individuals and entities, even though we expect that most registrants
will be entities. Using the example given by the commenter, the Federal
agency that possesses, uses, or transfers select agents or toxins would
be required to register and restrict access to such agents or toxins to
only those individuals approved by the Administrator or HHS Secretary
following a security risk assessment by the Attorney General. We are
making no change based on this comment.
One commenter requested that USDA and CDC consider a single
clearinghouse for registration of select agents. The commenter said the
rules require an entity that possesses only human and animal/plant
agents (no overlaps) to register separately with each agency; however,
this would place an undue burden on the entity by requiring dual
registration packages and safety/security plans. Another commenter
recommended that APHIS indicate what an entity can do to assist or
mitigate conflict between APHIS and CDC on registration applications
for overlap agents.
To simplify the registration process and minimize the burden on the
public, APHIS and CDC have established a framework by which individuals
and entities with various combinations of select agents and toxins may
submit their registration applications to either APHIS or CDC. For
instance, to apply for a certificate of registration for only PPQ or VS
select agents or toxins, or for PPQ and VS select agents or toxins, an
individual or entity must submit the registration application package
to APHIS. However, to apply for a certificate of registration for
overlap select agents or toxins, overlap select agents or toxins and
any combination of PPQ or VS select agents or toxins, or HHS select
agents or toxins and any combination of PPQ or VS select agents or
toxins, an individual or entity must submit the registration
application package to APHIS or CDC, but not both. In this final rule,
we are amending both sections to set out this new framework for
submitting registration applications (newly designated 7 CFR 331.7(d)
and 9 CFR 121.7(d)).
As previously discussed, APHIS and CDC are also developing a single
shared web-based system that will allow the regulated community to
conduct transactions electronically with either agency via a single web
portal. By providing a single web portal, APHIS and CDC will be able to
interact efficiently and effectively with the regulated community while
reducing the burden on the public. We envision that this system will
enable the entity to dynamically communicate with APHIS and CDC in a
digitally secured environment using a single web portal. The web portal
will provide a platform for electronic exchange of information. It will
allow entities to access data related to their own registration data
and allow them to create, amend, and submit registration applications;
requests for approvals for transfers, exemptions, or exclusions; and
any other required forms without the need to print, mail, or e-mail
hard copies. Hard copy registration materials and other required forms
will still be accepted. The single web portal will be available in
winter 2005.
Several commenters requested more information about the
registration process. One commenter asked how long will it take to
receive a certificate of registration after all the paperwork has been
submitted. The commenter urged APHIS to promptly process registration
applications so as not to disrupt valuable research and impede academic
planning. Another commenter suggested that APHIS add information to the
final rule to indicate when an entity should submit renewal
applications (i.e., at least 90 days prior to expiration).
We are committed to promptly processing initial registration
applications and renewal applications. The time needed to process a
registration application and issue a certificate of registration
depends on the complexity and completeness of the application. However,
to provide more guidance about the submission of renewal applications,
we recommend that the registration application and the information
necessary to conduct the required security risk assessments be
submitted at least 8 weeks prior to the expiration of the date of the
certificate of registration.
Interim 7 CFR 331.6(b)(1) and 9 CFR 121.7(b)(1) (newly designated 7
CFR 331.7 and 9 CFR 121.7) indicated that, as one of the conditions of
registration, the owner or controller of an entity must be approved by
APHIS following a security risk assessment by the Attorney General.
A commenter asked who would be deemed to own or control the entity
in the context of an academic institution. Another commenter thought
the phrase ``individual who controls the facility'' meant the senior
administrators to whom the responsible official reports and not the
members of the Board of Trustees.
The determination of who is an owner or controller of an academic
institution (i.e., institution of higher education) depends on whether
it is a public or private institution of higher education. Federal,
State, or local governmental agencies, including public institutions of
higher education, are exempt from the security risk assessment for the
entity and the individual who owns or controls such entity. However,
for a private institution of higher education, an individual will be
deemed to own or control the entity if the individual is in a
managerial or executive capacity with

[[Page 13256]]

regard to the entity's select agents or toxins or with regard to the
individuals with access to the select agents or toxins possessed, used,
or transferred by the entity. We consider an entity to be an
institution of higher education if it is an institution of higher
education as defined in the Higher Education Act of 1965 (20 U.S.C.
1001(a)) or an organization described in the Internal Revenue Code of
1986 (26 U.S.C. 501(c)(3)). Because entities that meet this criteria do
not have an owner, the individual(s) in control of the entity must be
approved by the Administrator or the HHS Secretary following a security
risk assessment by the Attorney General. For all other entities, an
individual will be deemed to own or control the entity if the
individual: (1) Owns 50 percent or more of the entity, or is a holder
or owner of 50 percent or more of its voting stock, or (2) is in a
managerial or executive capacity with regard to the entity's select
agents or toxins or with regard to the individuals with access to the
select agents or toxins possessed, used, or transferred by the entity.
To clarify the requirements for owners or controllers of an entity,
we are making several changes to the registration sections in this
final rule. We are making clear that the individuals must be approved
by the Administrator or HHS Secretary based on a security risk
assessment by the Attorney General (7 CFR 331.7(c)(1) and 9 CFR
121.7(c)(1)). We are also moving the information contained in footnote
4 in interim 7 CFR 331.6 and footnote 7 in interim 9 CFR 121.7 to a new
paragraph in both sections, 7 CFR 331.7(c)(2) and 9 CFR 121.7(c)(2),
which states that Federal, State, or local governmental agencies,
including public institutions of higher education, are exempt from the
security risk assessment for the entity and the individual who owns or
controls such entity. In addition, we are adding the following
paragraphs to both 7 CFR 331.7 and 9 CFR 121.7 to clarify who will be
deemed to own or control an entity and to indicate the criteria by
which an entity will be considered an institution of higher education:
For a private institution of higher education, an
individual will be deemed to own or control the entity if the
individual is in a managerial or executive capacity with regard to the
entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
For entities other than institutions of higher education,
an individual will be deemed to own or control the entity if the
individual: (1) Owns 50 percent or more of the entity, or is a holder
or owner of 50 percent or more of its voting stock; or (2) is in a
managerial or executive capacity with regard to the entity's select
agents or toxins or with regard to the individuals with access to the
select agents or toxins possessed, used, or transferred by the entity.
An entity will be considered to be an institution of
higher education if it is an institution of higher education as defined
in section 101(a) of the Higher Education Act of 1965 (20 U.S.C.
1001(a)), or is an organization described in 501(c)(3) of the Internal
Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).
Finally, we are adding a footnote to 7 CFR 331.7 and 9 CFR 121.7 to
clarify that more than one individual may meet the criteria for
ownership or control of an entity.
Interim 7 CFR 331.6(b)(2) and 9 CFR 121.7(b)(2) provided that APHIS
may issue a certificate of registration if, among other things, the
Administrator approves an entity's biosafety, containment, and
security.
In drafting this provision, we intended to stress to the regulated
community the importance of the biosafety, containment, and security
requirements. However, we did not intend to suggest that an individual
or entity did not have to meet the other requirements of the
regulations. Since the issuance of a certificate of registration is an
administrative action taken by APHIS, it is not necessary to include
this provision in the regulations. Accordingly, we are deleting this
provision in both sections.
Interim 7 CFR 331.6(b)(3) and 9 CFR 121.7(b)(3) provided that APHIS
may issue a certificate of registration if, among other things, the
Administrator determines that the individual or entity seeking to
register has a lawful purpose to possess, use, or transfer agents or
toxins.
One commenter stated that it is unclear how APHIS will determine if
the entity has an unlawful purpose to possess, use, or transfer select
agents. The commenter asked what information APHIS will use to make
this determination.
To determine whether an entity has a lawful purpose to possess,
use, or transfer select agents or toxins, APHIS will consider the
information contained in the registration application and any other
information available to APHIS about the entity. This determination
will be made on a case-by-case basis. However, since this is an
administrative action taken by APHIS, it is unnecessary to include this
provision in the regulations. Accordingly, we are deleting this
provision in both sections. In addition, we are amending newly
designated 7 CFR 331.7(f) and 9 CFR 121.7(f) to clarify that the
issuance of a certificate of registration may be contingent upon
inspection or submission of additional information, such as the
security plan, biocontainment/biosafety plan, incident response plan,
or any other documents required to be prepared under each part. These
changes will make the APHIS and CDC regulations consistent.
In interim 7 CFR 331.5(b) and 9 CFR 121.6(b), we provided that each
entity must designate an individual to be its responsible official and
that this individual must have the authority and control to ensure
compliance with the regulations. Furthermore, in interim 7 CFR 331.6(c)
and 9 CFR 121.7(d), we provided that a certificate of registration will
be valid for only the specific agents or toxins and specific activities
and locations listed on the certificate.
One commenter stated an entity should be able to apply for a single
certificate of registration to cover activities at all buildings on a
campus or site under the control and authority of the responsible
official, which would include both contiguous and dispersed sites
within a local geographical area. The commenter stated that it is
overly burdensome to require separate registrations for each general
physical location (defined as a building or a complex of buildings at a
single mailing address). The commenter claimed that the administrative
and control functions at research and academic institutions are
efficiently managed by a centralized department responsible for more
than one physical location. Similarly, a commenter stated that the
provisions concerning location should be amended to cover a single
administrative organization under a single responsible official.
Another commenter requested that the final regulations allow campuses
to designate responsible officials with responsibility for an entire
campus.
APHIS designed these provisions to ensure that the responsible
official has the requisite authority and control to ensure compliance
with the select agent regulations. We reasoned that a responsible
official would be better able to ensure compliance with the regulations
if he/she managed only one general physical location. While we still
believe that to be true, we recognize that some responsible officials
will be able to ensure compliance for an entire campus or business
complex. Therefore, in this final rule, the registration sections
(newly designated 7 CFR 331.7(g) and 9 CFR 121.7(g)) provide that a
certificate

[[Page 13257]]

of registration will be valid for one physical location (a room, a
building, or a group of buildings) where the responsible official will
be able to perform the responsibilities required in this part, for
specific select agents or toxins, and for specific activities. We
believe this change will provide more flexibility and guidance to
entities seeking to register.
In interim 7 CFR 331.6(d) and 9 CFR 121.7(e), we provided that a
certificate of registration may be amended to reflect changed
circumstances and that the responsible official must immediately notify
APHIS of such changes in circumstances that occur after submission of
the application for registration or after receipt of a certificate of
registration.
A commenter said that it is unclear how great a change would
require notification of APHIS or CDC. The commenter suggested that
investigators should instead submit annual reports of projects done and
projects planned. Another commenter stated that there is no specific
information in the regulations about what information must be reported
and what constitutes immediately (i.e., within 24 hours). The commenter
indicated that, if the entire registration application must be
resubmitted, then APHIS should allow a minimum of 7 to 10 business
days.
To clarify the requirements for amending a registration application
and a certificate of registration, in this final rule we are deleting
the provisions of interim 7 CFR 331.6(d) and 9 CFR 121.7(e). In their
place, we are adding a new paragraph (e) in newly designated 7 CFR
331.7 and 9 CFR 121.7 that requires the responsible official to provide
prompt notification of any changes in the registration application by
submitting the relevant page(s) of the registration application. In
addition, we are adding a new paragraph (h) in both sections to require
that, prior to any change, the responsible official must apply for an
amendment to a certificate of registration by submitting the relevant
page(s) of the registration application. Finally, to clarify the
requirements for when an entity loses the services of its responsible
official, we are adding a new paragraph (i) in both sections to require
an entity to immediately notify APHIS or CDC if it loses the services
of its responsible official. These paragraphs also provide that an
entity may continue to possess or use select agents or toxins only if
it appoints as the responsible official another individual who has been
approved by the Administrator or the HHS Secretary following a security
risk assessment by the Attorney General and who meets the requirements
of the regulations.
Interim 7 CFR 331.6(e) and 9 CFR 121.7(f) stated that a responsible
official who wishes to discontinue possessing, using, or transferring
an agent or toxin may inactivate the agent or toxin or he/she may
transfer the agent or toxin to a registered entity. Both sections
further provided that APHIS must be notified 5 business days prior to a
planned inactivation so that APHIS may have the opportunity to observe
the inactivation.
One commenter asked when APHIS will observe the destruction of a
select agent. Another commenter asked if a responsible official for a
diagnostic laboratory is required to notify APHIS 5 business days prior
to destroying a select agent or toxin.
In the final rule, we are deleting these paragraphs and simply
providing that a certificate of registration will be terminated upon
the written request of the entity if the entity no longer possesses or
uses any select agents or toxins and no longer wishes to be registered
(newly designated 7 CFR 331.7(j) and 9 CFR 121.7(j)). This change
should eliminate any confusion between this reporting requirement and
the reporting requirements for diagnostic exemptions.
The regulations (interim 7 CFR 331.6(f) and 9 CFR 121.7(g); newly
designated 7 CFR 331.7(k) and 9 CFR 121.7(k)) state that a certificate
of registration will be valid for a maximum of 3 years.
A commenter recommended that certificates of registration be valid
for 5 years to be consistent with the security risk assessments,
simplify paperwork requirements for the entity, and reduce cost to
government.
We believe it is reasonable to provide that a certificate of
registration will be valid for a maximum of 3 years. A 3-year
registration period takes into consideration the burden on the public
and the risks posed by select agents and toxins. In addition, it is
consistent with APHIS' permit systems and other established programs
for laboratory certification or registration (e.g., Clinical Laboratory
Improvement Amendments (CLIA) and the College of American Pathologists
(CAP)), which are generally valid for 2 to 3 years. Accordingly, we are
making no change based on this comment.

Denial, Revocation, and Suspension of Registration

Interim 7 CFR 331.7(a)(3) and 9 CFR 121.8(a)(3) provided that APHIS
may deny an application for registration or revoke registration if the
responsible official does not have a lawful purpose to possess, use, or
transfer listed agents or toxins. In addition, interim 7 CFR
331.7(a)(4) and 9 CFR 121.8(a)(4) provided that APHIS may deny an
application for registration or revoke registration if the responsible
official is an individual who handles or uses listed agents or toxins
and he/she does not have the necessary training or skills to handle
such agents or toxins. To be consistent with CDC, we are deleting these
provisions in this final rule.
Interim 7 CFR 331.7(a)(5) provided that APHIS may deny an
application for registration or revoke registration if the entity does
not meet the containment and security requirements prescribed by the
Administrator, while interim 9 CFR 121.8(a)(5) provided that APHIS may
deny an application for registration or revoke registration if the
entity does not meet the biosafety, containment, and security
requirements prescribed by the Administrator. In addition, interim 7
CFR 331.7(a)(6) provided that APHIS may deny an application for
registration or revoke registration if there are egregious or repeated
violations of the containment or security requirements, while interim 9
CFR 121.8(a)(6) provided that APHIS may deny an application for
registration or revoke registration if there are egregious or repeated
violations of the biosafety, containment, or security requirements.
In drafting these provisions, we wished to stress to the regulated
community the importance of the biosafety, containment, and security
requirements. However, we never intended to suggest that an entity did
not have to meet the other requirements of each part. Therefore, we are
amending these provisions in this final rule to provide that an
application may be denied or a certificate of registration revoked or
suspended if the individual or entity does not meet the requirements of
the applicable part (newly designated 7 CFR 331.8(a)(3) and 9 CFR
121.8(a)(3)). These changes will clarify the registration requirements
and make both sections consistent with CDC's regulations.
In addition, in this final rule, we are clarifying the actions an
entity must take in the event that APHIS suspends or revokes a
certificate of registration. Specifically, we are adding a paragraph to
require that, upon notification of suspension or revocation, an
individual or entity must: (1) Immediately stop all use of each select
agent or toxin covered by the revocation or suspension order; (2)
immediately safeguard and secure each select agent or toxin covered by
the revocation or suspension order from theft, loss, or release; and
(3) comply with all disposition instructions issued

[[Page 13258]]

by the Administrator for each select agent or toxin covered by the
revocation or suspension (newly designated 7 CFR 331.8(b) and 9 CFR
121.8(b)).
In a footnote to interim 7 CFR 331.7(a)(5) and 9 CFR 121.8(a)(5),
we indicated that APHIS may provide technical assistance and guidance
on the biosafety, containment, and security requirements. A commenter
requested information on when and to what degree APHIS will provide
such assistance.
As discussed below in the biocontainment/biosafety and security
sections, in this final rule we are providing a list of documents in
each part that an entity should consider in developing a
biocontainment/biosafety or security plan. We recommend that an entity
review these documents before contacting APHIS for technical
assistance. We will provide technical assistance and guidance upon
request.
Interim 7 CFR 331.7(b) and 9 CFR 121.8(b) provided that APHIS may
summarily revoke or suspend registration for any of the reasons set
forth in each section.
To clarify the provisions for denial, suspension, and revocation of
registration, in this final rule, we are deleting interim paragraph (b)
in both sections and simply providing that an application may be denied
or a certificate of registration revoked or suspended for the reasons
set forth in each section (newly designated 7 CFR 331.8(a) and 9 CFR
121.8(a)).
Interim 7 CFR 331.7(d) and 9 CFR 121.9(d) provided that the denial
of an application for registration, revocation of registration, and
suspension of registration may be appealed under each part. In this
final rule, newly designated 7 CFR 331.8(c) and 9 CFR 121.8(c) provide
that the denial of an application for registration and revocation of
registration may be appealed under each part. Furthermore, both
paragraphs provide that any denial of an application for registration
or revocation of a certificate of registration will remain in effect
until a final agency decision has been rendered. These changes will
clarify the status of an application for registration or a certificate
of registration during the appeal process.

Responsibilities of the Responsible Official

To facilitate compliance with the regulations, the regulations
(interim 7 CFR 331.9 and 9 CFR 121.10; newly designated 7 CFR 331.9 and
9 CFR 121.9) set out the responsibilities of the responsible official.
One commenter stated that the APHIS and CDC regulations should have
the same responsibilities for the responsible official and that these
responsibilities should be better defined.
We agree that the APHIS and CDC regulations should contain the same
provisions for the responsible official. Therefore, in this final rule,
we are amending newly designated 7 CFR 331.9(a) and 9 CFR 121.9(a) to
require that an individual or entity required to register under each
part designate an individual to be the responsible official. Paragraph
(a) further requires that the responsible official:
Be approved by the Administrator or the HHS Secretary
following a security risk assessment by the Attorney General;
Be familiar with the requirements of this part;
Have the authority and responsibility to act on behalf of
the entity;
Ensure compliance with the requirements of this part; and
Ensure that annual inspections are conducted for each
laboratory where select agents or toxins are stored or used in order to
determine compliance with the requirements of this part. The results of
each inspection must be documented, and any deficiencies identified
during an inspection must be corrected.
In addition, we are deleting the provision for the alternate
responsible official(s) from the registration section and adding it to
the responsible official section (newly designated 7 CFR 331.9(b) and 9
CFR 121.9(b)). These changes will make the APHIS and CDC regulations
consistent.
A commenter recommended that APHIS add the following language to
the regulations: ``This does not preclude the assignment of activities
in Sec. Sec. 121.10(a)(1) through 121.10(a)(8) to other individuals,
provided the activities are performed or supervised by a person
approved under Sec. 121.11 and the results are reviewed and approved
by the Responsible Official or Alternate Responsible Official.'' The
commenter stated that it would be inappropriate for the responsible
official to participate in the actual transferring of an agent or to
perform data entry to maintain records.
In response to this comment, in this final rule we are amending the
regulations to provide that the individual or entity required to
register under each part, and not the responsible official, must
provide training, maintain records, and provide notice of theft, loss,
or release of select agents or toxins (newly designated 7 CFR 331.15
and 9 CFR 121.15, 7 CFR 331.17 and 9 CFR 121.17, and 7 CFR 331.19 and 9
CFR 121.19). This change will allow the responsible official to
delegate certain responsibilities. For instance, interim 7 CFR
331.14(a) and 9 CFR 121.15(a) stated that the responsible official must
maintain complete, up-to-date records of information necessary to give
an accounting of all of the activities related to listed agents or
toxins. In this final rule, we are amending the regulations to require
the individual or entity to maintain such records (newly designated 7
CFR 331.17 and 9 CFR 121.17).
Interim 7 CFR 331.9(b) and 9 CFR 121.10(b) (newly designated 7 CFR
331.9 and 9 CFR 121.9) required the responsible official for a
diagnostic laboratory, or other entity possessing, using, or
transferring listed agents or toxins that are contained in specimens
presented for diagnosis to immediately report the identification of
such agents or toxins to the Administrator and to other appropriate
authorities when required by Federal, State, or local law. Furthermore,
both paragraphs provided that the Administrator may require less
frequent reporting during agricultural emergencies or outbreaks, or in
endemic areas.
In this final rule, we are amending newly designated 7 CFR 331.9(c)
and 9 CFR 121.9(c) to require the responsible official to report the
identification and final disposition of any select agent or toxin
contained in a specimen for diagnosis or verification. In addition, we
are adding a new paragraph (d) to 9 CFR 121.9 to require the
responsible official to report the identification and final disposition
of any select agent or toxin contained in a specimen presented for
proficiency testing. This information will help us to identify
outbreaks and to monitor activities related to select agents and
toxins.
We are also amending newly designated 9 CFR 121.9(c) to require the
responsible official to immediately report the identification of
specified select agents and toxins with a report of the final
disposition of the agent or toxin due within 7 calendar days after
identification. The responsible official must report the identification
and final disposition of the other select agents and toxins within 7
calendar days after identification. This will make the reporting
requirements for registered entities consistent with those in the
exemption sections (newly designated 9 CFR 121.5 and 121.6). Finally,
we are deleting in both sections the requirement that the
identification of a select agent or toxin be reported to appropriate
authorities when required

[[Page 13259]]

by Federal, State, or local law (interim 7 CFR 331.9(b) and 9 CFR
121.10(b)). This change corresponds to a similar change made in the
exemption sections (interim 7 CFR 331.4, 9 CFR 121.4, and 9 CFR 121.5).
One commenter requested clarification of the diagnostic exemptions
and the provisions of interim 9 CFR 121.10(b) requiring the responsible
official for a diagnostic laboratory to report identifications. The
commenter noted that exempt diagnostic laboratories are not required to
have a responsible official.
The reporting requirements in interim 9 CFR 121.10(b) (newly
designated 7 CFR 331.9(c) and 9 CFR 121.9(c)) pertain to registered
diagnostic laboratories. The regulations require that both exempt and
registered entities report the identification of a select agent or
toxin. We adopted these reporting requirements because this information
will help us to identify outbreaks and to monitor activities related to
select agents and toxins. Accordingly, we are making no change in
response to this comment.

Restricting Access/Security Risk Assessments

Interim 7 CFR 331.10 and 9 CFR 121.11 stated that an individual may
not have access to listed agents and toxins unless approved by APHIS
or, for overlap agents, APHIS or CDC. Both sections provided that APHIS
will grant, limit, or deny access approval and, interim 9 CFR 121.11,
provided that APHIS or CDC will make this determination for overlap
agents or toxins. Interim 7 CFR 331.10 and 9 CFR 121.11 further
provided that the responsible official is responsible for ensuring that
only approved individuals within the entity have access to agents or
toxins.
In this final rule, we are amending these sections to clarify that
an individual must be approved for access by the Administrator or the
HHS Secretary following a security risk assessment by the Attorney
General (newly designated 7 CFR 331.10 and 9 CFR 121.10). In addition,
we are deleting the provision that the responsible official is
responsible for ensuring that only approved individuals have access to
select agents or toxins. This change will make it clear that the
registrant and the individual are responsible for ensuring that the
individual does not have access to any select agent or toxin unless
approved by the Administrator or the HHS Secretary.
Several commenters requested information about the security risk
assessments conducted by the Attorney General.
To obtain a security risk assessment, an individual or entity must
submit a completed FBI Form FD-961 and two legible fingerprint cards,
printed by a local law enforcement agency, to the Criminal Justice
Information Services (CJIS) Division of the Federal Bureau of
Investigation. Fingerprint cards and FBI Form FD-961 may be obtained by
calling (304) 625-4900. FBI Form FD-961 is also available on the
Internet at http://www.fbi.gov/terrorinfo/bioterrorfd961.htm. It would

be impractical to include this information in the regulations because
the Attorney General determines the information and processes required
for a security risk assessment. Accordingly, we are making no change
based on these comments.
One commenter recommended that security risk assessments be
completed within 2 weeks. Another commenter stated that a person should
be permitted to work with select agents or toxins under the direct
supervision of an approved person if the individual subject to the
background check suffers a delay in excess of 10 working days.
Security risk assessments are conducted by the Attorney General,
not APHIS. The time required to complete a security risk assessment
depends on the completeness of the application and the results of the
database search. In general, a security risk assessment may be
completed in 45 days. However, in certain cases, additional time may be
needed to verify the results of the database search. We are making no
changes based on these comments.
A commenter asserted that personnel screening should include, at a
minimum, a criminal background check, credit check, and random drug
screening.
In accordance with the Act, each individual identified by the
responsible official must undergo a security risk assessment. The Act
does not require a credit check or random drug screening. However, this
does not preclude an entity from having more stringent personnel
screening for individuals with access to select agents or toxins.
Accordingly, we are making no changes based on this comment.
Interim 7 CFR 331.10(b) and 9 CFR 121.11(b) required the
responsible official to request access approval for only those
individuals who have a legitimate need to handle or use listed agents
or toxins, and who have the appropriate training and skills to handle
such agents and toxins.
APHIS received a number of comments dealing with the term
``access.'' A commenter stated that judgments about an individual's
need to handle agents and the adequacy of their training and skills is
a matter for the responsible official, not APHIS. This commenter
recommended that APHIS rely upon the responsible official to make
informed judgments about an individual's need for access and their
proficiency in handling select agents and toxins. One commenter noted
the term ``access'' is used to describe two distinct situations--access
to select agents and toxins by individuals who are authorized to handle
and use them, and approved entry to an area where select agents or
toxins are present by individuals who are not authorized to handle or
use such agents or toxins. Several commenters recommended that APHIS
define the term ``access'' as the ``ability to gain physical control of
select agents and toxins.'' Another commenter suggested the word
``access'' be changed to ``handle or use'' throughout the regulations.
The commenter noted that many people may have access to a containment
space but never handle or use agents or toxins. Similarly, one
commenter argued that the regulations are conceptually flawed because
they focus on restricting access to the laboratory rather than to the
select agent or toxin. The commenter said that numerous individuals
need to access lab space for a variety of reasons and that it is
unnecessary and burdensome to require that they be continually escorted
or undergo security risk assessments. Another commenter recommended
that APHIS define the term ``entry,'' which would refer to admission of
unapproved individuals into an area where select agents and toxins are
present.
In the December 2002 interim rule, we provided that an individual
may not have access to listed agents or toxins unless approved by APHIS
or, for overlap agents or toxin, APHIS or CDC. We required access
approval for each individual with a legitimate need to handle or use
agents or toxins, and the necessary training and skills to handle such
agents or toxins. We continue to believe that individuals that handle
or use select agents or toxins must be approved for such access.
However, we agree with the commenters that access approval should also
be required for individuals who have the ability to gain possession.
Therefore, this final rule provides that an individual will be deemed
to have access at any point in time if the individual has possession of
a select agent or toxin (e.g., carries, uses, or manipulates) or the
ability to gain possession of a select agent or toxin (newly designated
7 CFR 331.10(b) and 9 CFR 121.10(b)). In addition, we are

[[Page 13260]]

requiring in both sections that each individual with access to select
agents or toxins have the appropriate education, training, and/or
experience to handle or use such agents or toxins (newly designated 7
CFR 331.10(c) and 9 CFR 121.10(c)). However, in this final rule, we are
removing the requirement that the responsible official submit
information about an individual's training and skills to APHIS (interim
7 CFR 331.10(e) and 9 CFR 121.11(e)). These changes will make it clear
that the registered individual or entity, and not APHIS, is responsible
for ensuring that an individual with access to select agents or toxins
has the appropriate education, training, and/or experience to handle
such agents or toxins.
Several commenters argued that access approval should be portable
from entity to entity, from location to location, and from project to
project for the duration of the valid period. A commenter stated that
delays in access approval could be avoided if an individual's approval
was portable. Another commenter asked if an individual will need a new
security risk assessment if he or she has already been cleared at one
entity but will visit another entity to conduct research.
We do not believe it is necessary to make an individual's access
approval portable in order to avoid delays in such approval. The
Administrator or the HHS Secretary may grant access approval to an
individual following a security risk assessment by the Attorney
General. A security risk assessment may be completed in 45 days unless
additional time is needed to verify the database search results.
However, in recognition of the need for flexibility for visiting
researchers, APHIS, CDC, and the Attorney General have developed
procedures by which an approved individual may visit another registered
entity without having to undergo another security risk assessment by
the Attorney General. Specific guidance on these procedures is
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index/html.
We note that an individual who ceases to be

employed by the entity at which he/she originally received access
approval must obtain new access approval through his/her new employer.
We are making no changes to the regulations in response to these
comments.
A commenter asserted that the L or Q clearances (or their
equivalent) granted in Department of Energy laboratories should be
considered synonymous with the security risk assessment, and,
therefore, approved.
Section 212(e) of the Act requires that registered persons provide
access to select agents and toxins to only those individuals that have
a legitimate need to handle or use such agents and toxins, and that
those individuals undergo a security risk assessment by the Attorney
General. The Act provides no exemption for Federal clearances.
Accordingly, we are making no change based on this comment.
The regulations (interim 7 CFR 331.10(f) and 9 CFR 121.11(f); newly
designated 7 CFR 331.10(e) and 9 CFR 121.10(e)) provide that the access
approval process for individuals may be expedited upon request by the
responsible official and a showing of good cause.
Several commenters stated that APHIS and the Attorney General
should establish timelines for responding to requests for expedited
review for security risk assessments.
We do not believe it is necessary to establish timelines for
responding to requests for expedited review for security risk
assessments. In our experience, an expedited security risk assessment
can be completed within a week, barring any complications. Therefore,
we are making no change based on this comment.
Another commenter asked what constituted ``good cause'' for
expedited review of access approval. This commenter asserted that
Federal clearances should be a reason for expedited review.
This final rule cites several examples of good cause to expedite a
security risk assessment (e.g., public health or agricultural
emergencies, national security, a short-term visit by a prominent
researcher). We do not believe that a Federal clearance alone is
sufficient reason to expedite a security risk assessment. Thus, we are
making no change in response to this comment.
Interim 7 CFR 331.10(h) and 9 CFR 121.11(h) provided that APHIS may
deny or limit access of an individual to agents or toxins if:
The Attorney General identifies the individual as a
restricted person under 18 U.S.C. 175b;
The Attorney General identifies the individual as
reasonably suspected by any Federal law enforcement or intelligence
agency of (1) committing a crime set forth in 18 U.S.C. 2332b(g)(5),
(2) knowing involvement with an organization that engages in domestic
or international terrorism (as defined in 18 U.S.C. 2331) or with any
other organization that engages in intentional crimes of violence, or
(3) being an agent of a foreign power as defined in 50 U.S.C. 1801;
The Administrator determines that the individual does not
have a legitimate need to handle listed agents or toxins;
The individual does not have the necessary training and
skills to handle listed agents or toxins; or
The Administrator determines that such action is necessary
to protect plant health or plant products, or animal health or animal
products.
In this final rule, newly designated 7 CFR 331.10(f) and 9 CFR
121.10(f) provide that an individual's access approval may be denied,
limited, or revoked if the individual is a restricted person under 18
U.S.C. 175b or is reasonably suspected by any Federal law enforcement
or intelligence agency of committing a crime set forth in 18 U.S.C.
2332b(g)(5), knowing involvement with an organization that engages in
domestic or international terrorism (as defined in 18 U.S.C. 2331) or
with any other organization that engages in intentional crimes of
violence, or being an agent of a foreign power as defined in 50 U.S.C.
1801. This has always been the way these provisions have been
interpreted; however, we are making this change to both sections for
clarification purposes.
To be consistent with a change made in the section pertaining to
denial, revocation, or suspension of registration (newly designated 7
CFR 331.8 and 9 CFR 121.8), in this final rule we are deleting the
provision that the Administrator may deny, limit, or revoke an
individual's access approval if the individual does not have a
legitimate need to handle select agents or toxins. In addition, we are
deleting the provision pertaining to an individual's training and
skills to be consistent with CDC's regulations.
A commenter stated that limited access, whereby the individual can
only handle or use the agent or toxin under the direct supervision of
an approved individual, is impractical. The commenter noted that each
faculty member, postdoctoral fellow, or student who is a member of a
research team is expected to make significant, independent
contributions to research; also, it would be too burdensome for
institutions to track whether individuals have full or limited access.
The commenter stated that provisions for limited access would be
unnecessary if the regulations included a precise definition of access.
Section 212(e)(2) of the Act provides for limited access approval.
The Administrator will determine what constitutes limited access on a
case-by-case basis. The determination will take into consideration all
of the facts at

[[Page 13261]]

hand and be commensurate with the risks posed by the select agent or
toxin. We are making no change based on this comment.
One commenter argued that the Attorney General should allow the
research community to comment on how the definition of ``restricted
person'' will be interpreted and applied. This commenter stated that,
while the Attorney General is bound by statutory language in the
respective categories, interpretation will be required to make the
definitions operational. For instance, the commenter asked if a
scientist who has fled political persecution in another country, and
who may therefore have an outstanding foreign arrest warrant, would be
considered a restricted person. Another commenter recommended that the
Administrator reserve the authority, in exceptional circumstances, to
allow individuals deemed ineligible to have access to select agents and
toxins for a limited time. The commenter stated that it is in the
national interest to take a nuanced approach that takes into account
the contributions the individual may be able to make to the country.
This commenter stated there should be an opportunity for individuals
and their sponsoring institutions to make the argument that an
individual has exceptional talent and insight that should be used to
advance research, and that an individual does not present a security
risk, even if he or she meets the criteria for a restricted person.
The statutory requirements are clear, and it is not necessary for
the research community to assist in the interpretation and application
of the term `restricted person.' In accordance with the Act, the
Administrator may limit or deny access to PPQ and VS select agents and
toxins to individuals whom the Attorney General has identified as a
``restricted person'' under 18 U.S.C. 175b. Furthermore, the
Administrator must deny access to overlap select agents and toxins to
individuals whom the Attorney General has identified as a ``restricted
person.'' According to 18 U.S.C. 175b, ``the term ``restricted person''
means an individual who:
Is under indictment for a crime punishable for a term
exceeding 1 year;
Has been convicted in any court of a crime punishable by
imprisonment for a term exceeding 1 year;
Is a fugitive from justice;
Is an unlawful user of any controlled substance (as
defined in section 102 of the Controlled Substances Act (21 U.S.C.
802));
Is an alien illegally or unlawfully in the United States;
Has been adjudicated as a mental defective or has been
committed to any mental institution;
Is an alien (other than an alien lawfully admitted for
permanent residence) who is a national of a country as to which the
Secretary of State, pursuant to section 6(j) of the Export
Administration Act of 1979 (50 U.S.C. App. 2405(j), section 620A of
chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C.
2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22
U.S.C. 2780(d)), has made a determination (that remains in effect) that
such country has repeatedly provided support for acts of international
terrorism; or
Has been discharged from the Armed Services of the United
States under ``dishonorable conditions.''
Based on the foregoing, we are making no change in response to this
comment.
Interim 7 CFR 331.10(g) and 9 CFR 121.11(g) provided that APHIS
will notify the responsible official if an individual is granted full
or limited access, or denied access to listed agents or toxins. Both
sections further provided that APHIS will notify the individual if he/
she is denied access or is granted only limited access.
Several commenters recommended that any entities or individuals
denied access to select agents and toxins be notified of the reasons
for the denial; otherwise, they are unable to make a meaningful request
for an administrative review.
APHIS will provide written notice of any denial, limitation, or
revocation of access approval, including the reason(s) therefore.
However, since this is an administrative action ``taken'' by APHIS, it
is unnecessary to include this information in the regulations.
Accordingly, we are deleting this paragraph in both sections in this
final rule.
The regulations (interim 7 CFR 331.10(j) and 9 CFR 121.11(k); newly
designated 7 CFR 331.10(h) and 9 CFR 121.10(i)) provide that access
approval is valid for a maximum of 5 years.
One commenter recommended that APHIS reconsider the timeframes for
renewal of registration packages (3 years) and access approval (5
years). The commenter stated that it would be easier for the regulated
community if the renewals were concurrent and could be sent at one
time.
In establishing the timeframe for registration, we took into
consideration the risks of the select agents and toxins and the fact
that APHIS' permits are valid for a similar timeframe, while, in
establishing the timeframe for access approvals, we took into
consideration the burden on the public and the fact that the Act allows
for approvals to be valid for up to 5 years. We believe that these
timeframes are reasonable and consistent with the requirements of the
Act. We do not believe that it will be easier for the regulated
community if the renewals are concurrent and can be sent at one time.
Access approvals are granted by the Administrator or the HHS Secretary
on a rolling basis due to frequent staff changes at entities and
variations in the time it takes for the Attorney General to conduct an
individual's security risk assessment. If APHIS adopted the same
timeframe for registration and access approval, it is likely that some
individuals in an entity would have to renew their access approvals in
a much shorter timeframe than other individuals in the same entity. We
believe this would cause undue burden on the public. Accordingly, we
are making no changes based on this comment.
The regulations (interim 7 CFR 331.10(k) and 9 CFR 121.11(l); newly
designated 7 CFR 331.10(i) and 9 CFR 121.10(j)) require immediate
notification when an individual's access to agents or toxins is
terminated by the entity and the reasons therefore.
A commenter requested clarification as to what constitutes
``immediately.'' The commenter stated that large entities would find it
difficult to provide written notices within 24 hours. The commenter
recommended that APHIS require an initial notification by phone or fax
within 72 hours that is followed up by a written notice within 7
business days.
The regulations do not require written notice of a termination of
access. Notice of a termination of access may be provided by telephone,
fax, or e-mail. We are making no change in response to this comment.

Security

Interim 7 CFR 331.11 required that an individual or entity develop
and implement a Biocontainment and Security Plan. Interim 9 CFR 121.12
contained similar requirements for a Biosafety and Security Plan. In
both sections, paragraph (a)(2) stated that the security systems and
procedures must be designed according to a site-specific risk
assessment and provide graded protection in accordance with the threat
posed by the agent or toxin. Both sections also set out the types of
information that should be contained in the security plan.
A commenter asserted that biological lab security should be
administered by only one Federal agency (i.e, the Department of
Homeland Security) to ensure consistency.

[[Page 13262]]

Section 212(b) of the Act requires APHIS to establish and enforce
safeguard and security measure to prevent access to select agents and
toxins for use in domestic or international terrorism or for any other
criminal purpose. In addition, the Act provides for interagency
coordination between APHIS and CDC regarding overlap select agents and
toxins. As discussed below, APHIS and CDC have amended the regulations
so that the security requirements are identical and APHIS and CDC have
established procedures to ensure consistent regulation of select agents
and toxins. For these reasons, we are making no change in response to
this comment.
A commenter recommended that APHIS and CDC adopt identical security
provisions. Several commenters asked whose security, inspection, and
compliance standards will be used for overlap agents--APHIS' or CDC's.
These commenters also asked what will happen if APHIS and CDC do not
concur.
Both the APHIS and CDC select agent regulations apply to overlap
select agents and toxins. To eliminate confusion about whose security
standards will be used for overlap select agents and toxins, we are
amending the security sections in this final rule so that the APHIS and
CDC security requirements are identical (newly designated 7 CFR 331.11
and 9 CFR 121.11). These changes are discussed in detail below. We
believe these changes will help to ensure consistent regulation of
select agents and toxins by APHIS and CDC, including compliance
inspections. We note that compliance inspections for security will be
based on the regulations and that inspectors will be looking for
security that provides graded protection commensurate with the risk of
the select agent or toxin, given its intended use.
Several commenters expressed concern that the regulations do not
provide for preclearance of security plans before an entity invests in
a security system.
In this final rule, we recommend that an individual or entity
consider the following document when developing a security plan--
``Laboratory Security and Emergency Response Guidance for Laboratories
Working With Select Agents,'' in Morbidity and Mortality Weekly Report.
An individual or entity should review this document before contacting
APHIS for technical assistance. We will provide technical assistance
and guidance upon request. However, in recognition of the commenters'
concerns, we note that APHIS and CDC are working with interagency
groups and security experts to draft a document that will provide
additional guidance about the security required for select agents and
toxins. This document will be available in spring 2005. We will provide
this guidance document to the regulated community when it is available.
A commenter stated that the regulations should clearly distinguish
between lab security and entity security, especially for large academic
settings where a secure lab may coexist with educational and research
labs.
We disagree. The security regulations are designed to prevent
unauthorized access, theft, loss, or release of select agents and
toxins. The regulations require that an entity's security plan be
designed according to a site-specific risk assessment. Such a risk
assessment would take into consideration the security needed for a
select agent lab in a large academic setting. Therefore, we are making
no change based on this comment.
One commenter asked what constituted an adequate description of
safety and security in the required plans. Another commenter asked who
will judge the adequacy of a security plan.
A security plan must be sufficient to safeguard the select agent or
toxin against unauthorized access, theft, loss, or release. APHIS or
CDC will determine if a security plan is adequate. We are making no
changes in response to these comments.
The introductory text in interim 7 CFR 331.11(a)(2) and 9 CFR
121.12(a)(2) stated that the security systems and procedures must be
designed according to a site-specific risk assessment and must provide
graded protection in accordance with the threat posed by the agent or
toxin. Both sections further provided that the site-specific risk
assessment should involve a threat assessment and risk analysis in
which threats are defined, vulnerabilities examined, and risks
associated with those vulnerabilities identified. Both sections also
stated that the security systems and procedures must be tailored to
address site-specific characteristics and requirements, ongoing
programs, and operational needs and must mitigate the risks identified.
A commenter suggested replacing the phrase ``in accordance with the
threat posed by the agent'' with the phrase ``in accordance with the
consequences posed by the agent or toxin.'' Another commenter pointed
out that the terms ``risk assessment,'' ``threat assessment,''
``vulnerability assessment,'' and ``threats'' are confusing to those
with little experience in this area and should be clarified. A
commenter suggested that APHIS replace the phrase ``risks associated
with those vulnerabilities are mitigated'' with the phrase
``consequences associated with those vulnerabilities are mitigated.''
In response to these comments, in this final rule we are deleting
this text in both sections and adding in its place the requirement that
an entity's security plan be sufficient to safeguard the select agent
or toxin against unauthorized access, theft, loss, or release (newly
designated 7 CFR 331.11(a) and 9 CFR 121.11(a)). In addition, we are
amending both sections to require that the security plan be designed
according to a site-specific risk assessment and provide graded
protection in accordance with the risk of the select agent or toxin,
given its intended use. We believe these changes will clarify the
requirements and make the text in this section consistent with other
sections in the regulations (e.g., biocontainment/biosafety).
One commenter recommended that entities be required to comply with
Appendix F of the BMBL as well as the specific USDA manuals cited in
the rule. The commenter stated that this would mandate the use of
state-of-the-art approaches for safety and security. A commenter stated
that the security regulations are inadequate (i.e., key locks and key
control) and recommended that the pathogens be secured with a modern
access control system. Another commenter stated that the regulations
should specify minimum security standards. The commenter recommended
the following: (1) A minimum of three levels of access control (e.g.,
access to the building, access to the wing of the building, and access
to the laboratory); (2) a minimum of two levels of access control with
video surveillance; (3) a minimum of one level of access control with
security personnel; and (4) a minimum of one level of access control
with an alarm system with off-site monitoring.
On the other hand, several commenters recommended a performance
standard for compliance with the regulations. One commenter stated that
Appendix F of the BMBL does not provide appropriate guidance for
developing a performance-based security program because it implies the
need for a rigorous security program applicable uniformly to all
biosafety levels. The commenter noted that overly prescriptive
requirements will impede the development of effective and affordable
plans and will result in constraining the availability of select agents
and toxins for the legitimate

[[Page 13263]]

purposes specified in the Act. Another commenter stated that toxins
should not be subject to the same biocontainment and security measures
as viruses, bacteria, fungi, and plant pathogens (which are capable of
replication). The commenter suggested a two-tiered approach, with a
higher level of security and biocontainment for materials that can be
propagated. Similarly, a commenter stated the security requirements
should recognize that not all listed agents are equal from a
weaponization perspective; therefore, a set of graded protection
requirements should be established so that the most dangerous pathogens

and the most likely to be weaponized are protected at higher levels
than the majority of the select agents.
Because different select agents and toxins pose differing degrees
of risk, we believe it would be counterproductive to attempt to prepare
a detailed list of prescriptive requirements for entities (i.e., a
``one size fits all'' design standard). Therefore, the regulations
contain performance standards for biocontainment/biosafety, security,
and incident response that take into account the risks presented by a
particular agent or toxin, given its intended use.
With regard to security, newly designated 7 CFR 331.11 and 9 CFR
121.11 require each individual or entity required to register under
each part to develop and implement a written security plan. This
security plan must be designed according to a site-specific risk
assessment and must provide graded protection in accordance with the
risk of the select agent or toxin, given its intended use. In addition,
newly designated 7 CFR 331.11 and 9 CFR 121.11 require the individual
or entity to adhere to specified security requirements or implement
measures to achieve an equivalent or greater level of security. We
believe these security provisions provide enough flexibility and
specificity to allow an individual or entity to develop and implement a
security plan that will safeguard the select agent or toxin against
unauthorized access, theft, loss, or release.
However, in recognition of the commenters' concerns, we reiterate
that APHIS and CDC are working with interagency groups and security
experts to draft a document that will provide additional guidance about
the security required for select agents and toxins. This document will
be available in spring 2005. The 5th edition of the BMBL, which is
under development, will provide additional guidance on laboratory
security.
Interim 7 CFR 331.11(a)(2)(iii) and 9 CFR 121.12(a)(2)(iii)
required that the security plan describe, among other things,
cybersecurity.
One commenter recommended that the term cybersecurity be replaced
with ``information and cybersecurity.'' The commenter also recommended
spelling out the assets that should be protected and how they are to be
protected.
In this final rule, we are amending these provisions by removing
the word ``cybersecurity'' and adding in its place the words
``information systems control'' (newly designated 7 CFR 331.11(c)(1)
and 9 CFR 121.11(c)(1)). This change is consistent with changes made
throughout this final rule to ensure that information about select
agents and toxins is protected.
Interim 7 CFR 331.11(a)(2)(iv) and 9 CFR 121.12(a)(2)(iv) provided
that, with respect to areas containing listed agents or toxins, an
entity or individual must adhere to the specified security requirements
or implement measures to achieve an equivalent or greater level of
security.
Two commenters requested clarification of the term ``area'' with
regard to large multi-use laboratories. One commenter stated there is
little benefit in terms of security to require access control,
specialized training, and personnel background checks for individuals
who are only sharing lab space with individuals working with select
agents or toxins. Another commenter suggested that the regulations
should be flexible enough to allow local solution of this issue (i.e.,
allowing the entity to designate a portion of the lab as a select agent
area for which use and entry restrictions would be governed by the
regulations). A commenter recommended that, where labs are used
intermittently for select agent research, free access be permitted when
select agents and toxins are not in use and when the agents/toxins are
secured in a safe or other secured storage.
As previously noted, the security requirements are designed to
prevent unauthorized access, theft, loss, or release of select agents
and toxins. We believe the regulations provide enough flexibility for
an entity to determine the best way to accomplish this goal. However,
since the term ``area'' appears to be confusing, in this final rule we
are deleting the phrase ``with respect to areas containing listed
agents or toxins'' (newly designated 7 CFR 331.11(d) and 9 CFR
121.11(d)).
Interim 7 CFR 331.11(a)(2)(iv)(A) and 9 CFR 121.12(a)(2)(iv)(A)
stated that an entity must allow unescorted access only to those
approved individuals who are performing a specifically authorized
function during hours required to perform that job.
In its final rule, CDC is amending the comparable provision in its
rule in response to comments. To be consistent with CDC's regulations,
we are making a corresponding change in this final rule. Specifically,
we are amending both sections to provide that an entity may allow
access only to individuals with access approval from the Administrator
or the HHS Secretary (newly designated 7 CFR 331.11(d)(1) and 9 CFR
121.11(d)(1)).
Interim 7 CFR 331.11(a)(2)(iv)(B) and 9 CFR 121.12(a)(2)(iv)(B)
required that individuals who are not approved under Sec. Sec. 331.10
or 121.11, respectively, be allowed to conduct routine cleaning,
maintenance, repairs, and other non-laboratory functions only when
escorted and continually monitored.
A commenter requested clarification of the terms ``escorting'' and
``continually monitored.''
These terms are commonly understood and do not require further
clarification in the regulations. However, upon further review, we are
amending these provisions to make it clear that an individual who is
not approved for access by the Administrator or the HHS Secretary may
conduct routine cleaning, maintenance, repairs, and other activities
not related to select agents or toxins only when continuously escorted
by an approved individual (newly designated 7 CFR 331.11(d)(2) and 9
CFR 121.11(d)(2)).
Interim 7 CFR 331.11(a)(2)(iv)(C) and 9 CFR 121.12(a)(2)(iv)(C)
required entities and individuals to control access to containers where
listed agents and toxins are stored by requiring that such containers
be locked when not in the direct view of an approved individual and by
using other monitoring measures, as needed.
One commenter stated that the phrase, ``when not in direct view of
an approved individual,'' implies that these areas do not need to be
secured when an authorized person is present, and that this is
inappropriate. The commenter said that an area containing select agents
should be secure at all times and that only authorized persons should
have access to a freezer. The commenter stated that an individual
should not bear the burden of being responsible for the security of the
freezer. Another commenter argued that this requirement is
unnecessarily stringent and is not feasible in many labs. This
commenter recommended that the agent or toxin be under the direct
control of an individual, meaning that an unauthorized person could

[[Page 13264]]

approach the agent or toxin without coming into the view of approved
staff. A commenter stated there is no need to require locked
containers. The commenter noted that a freezer that is located outside
an access-controlled area should be locked, while a freezer that is
located inside such an area need not be locked.
We agree that containers where select agents and toxins are stored
must be secured against unauthorized access at all times. Accordingly,
we are amending both sections to state that an entity must control
access to containers by requiring that freezers, refrigerators,
cabinets, and other containers be secured against unauthorized access
(newly designated 7 CFR 331.11(d)(3) and 9 CFR 121.11(d)(3)).
Interim 7 CFR 331.11(a)(2)(iv)(D) and 9 CFR 121.12(a)(2)(iv)(D)
required the inspection of all packages upon entry and exit.
Several commenters stated that it is not practical to require
inspection of all packages upon entry and exit, that doing so provides
almost no security value, and that doing so may be unsafe. One
commenter asked if the requirement applied to packages of agents being
shipped/received or if it applied to briefcases, backpacks, etc.
Another commenter asked if sharps containers or Petri dishes must be
inspected.
We agree that it is not practical to require inspection of all
packages upon entry and exit. Therefore, in this final rule, we are
amending both sections to require that an entity inspect all suspicious
packages before they are brought into or removed from an area where
select agents or toxins are used or stored (newly designated 7 CFR
331.11(d)(4) and 9 CFR 121.11(d)(4)).
Interim 7 CFR 331.11(a)(2)(iv)(E) and 9 CFR 121.12(a)(2)(iv)(E)
required an entity to establish a protocol for intra-entity transfers,
including provisions for ensuring that the packaging and movement is
conducted under the supervision of an approved individual.
A commenter stated that the requirement for a protocol for intra-
entity transfers is vague and inadequate. The commenter suggested that
intra-entity movement of select agents should follow a documented chain
of custody process that minimizes any possibility of diversion.
We agree. Therefore, in this final rule, we are amending both
sections to require entities to establish a protocol for intra-entity
transfers, including chain of custody documentation and provisions for
ensuring that packaging and movement is conducted under the supervision
of an individual with access approval from the Administrator or the HHS
Secretary, including chain-of-custody documents and provisions for
safeguarding against theft, loss, or release (newly designated 7 CFR
331.11(d)(5) and 9 CFR 121.11(d)(5)). This change is consistent with
the recordkeeping requirements in newly designated 7 CFR 331.17 and 9
CFR 121.17.
To be consistent with CDC's regulations, we are adding a new
paragraph (d)(8) in 7 CFR 331.11 and 9 CFR 121.11 that requires an
individual or entity to separate areas where select agents and toxins
are stored or used from the public areas of the building.
One commenter stated that the BMBL and NIH Guidelines require labs
to post biohazard signs on access doors that list the agents present in
the lab, which may compromise lab security.
In this final rule, 9 CFR 121.12 (Biosafety) provides that an
individual or entity should consider the BMBL and NIH Guidelines when
developing a biosafety plan. However, it is the entity's responsibility
to determine if posting biohazard signs on access doors would
compromise lab security. We are making no change based on this comment.

Biocontainment/Biosafety

Interim 7 CFR 331.11 required individuals and entities to develop
and implement a Biocontainment and Security Plan that is commensurate
with the risk of the agent or toxin, given its intended use. It also
required that the containment procedures be sufficient to contain the
agent or toxin (e.g., physical structure and features of entity, and
operational and procedural safeguards). Interim 9 CFR 121.12 contained
similar requirements for a Biosafety and Security Plan.
In this final rule, newly designated 7 CFR 331.12 requires that an
individual or entity develop and implement a written biocontainment
plan that is commensurate with the risk of the select agent or toxin,
given its intended use. Newly designated 9 CFR 121.12 contains similar
requirements for a biosafety plan. The titles and provisions of the
plans are different because the select agents and toxins listed in 7
CFR 331.3 do not pose a severe threat to human health and, therefore,
it is unnecessary to require that the plant-related plan address
personnel safety and health.
Several commenters stated that the biosafety section in the final
rule should reference existing Department of Health and Human Services
guidelines and current Occupational Safety and Health Administration
(OSHA) regulations as authoritative codes of practice that entities
should consider in developing and implementing a performance-based
safety plan. On the other hand, several commenters urged APHIS and CDC
to develop joint biosafety guidelines for select agents that would
supplant the BMBL and NIH Guidelines.
In this final rule, we are retaining the existing performance
standard but we are providing a list of references that an individual
or entity should consider in developing its biocontainment/biosafety
plan (newly designated 7 CFR 331.12(c) and 9 CFR 121.12(c)). This
change should provide more guidance on acceptable biosafety practices.

Restricted Experiments

In interim 9 CFR 121.10(c), we provided that the responsible
official must ensure that the following experiments are not conducted
unless approved by the Administrator, after consultation with experts:
(1) Experiments utilizing recombinant DNA that involve the deliberate
transfer of a pathogenic trait or drug resistance trait to biological
agents that are not known to acquire the trait naturally, if such
acquisition could compromise the use of the drug to control disease
agents in humans, veterinary medicine, or agriculture; and (2)
experiments involving the deliberate formation of recombinant DNA
containing genes for the biosynthesis of toxins lethal for vertebrates
at an LD50 < 100 ng/kg body weight.
We adopted this provision in the December 2002 interim rule in
order to be consistent with CDC and to address concerns about
laboratory manipulation of microbes that alter their characteristics
(e.g., increased virulence, pathogenicity, or host range; alter mode of
transmission or route of transmission) and increase the risks to human,
animal, or plant health. At the time, we did not believe it was
necessary to require approval for experiments involving recombinant DNA
of PPQ select agents because these experiments are regulated under 7
CFR part 340. However, we are adding this provision to 7 CFR part 331
in this final rule to ensure that these experiments are covered and to
provide consistency in the select agent regulations.
To facilitate compliance with these requirements, in this final
rule we are moving these provisions to a new section in each part
titled, ``Restricted experiments'' (7 CFR 331.13 and 9 CFR 121.13,
respectively), and we are adding a footnote to both sections that
indicates that guidance on the requirements for experiments involving
recombinant DNA may be obtained from the publication, ``NIH Guidelines
for

[[Page 13265]]

Research Involving Recombinant DNA Molecules.'' Moreover, 7 CFR 331.13
provides that these experiments must be conducted under conditions
prescribed by the Administrator, and that the Administrator may revoke
approval to conduct these experiments, or suspend or revoke a
certificate of registration, if the individual or entity fails to
comply with the requirements of that part. A corresponding provision in
9 CFR 121.13 provides for consultation with the HHS Secretary. This has
always been the way we have interpreted all of these requirements;
however, we are adding these provisions to both sections for clarity.
One commenter stated that the inclusion of the words ``pathogenic
trait'' establishes an additional class of experiments that require
approval from the Administrator. The commenter recommended that the
APHIS and CDC requirements be identical.
We agree. Accordingly, we are deleting the words ``pathogenic
trait'' in both sections of this final rule (newly designated 7 CFR
331.13(a)(1) and 9 CFR 121.13(a)).
One commenter stated that the regulations should be amended to
refer to the NIH Guidelines rather than list the types of experiments
that are restricted in the regulations. The commenter noted that the
NIH Guidelines are subject to change and the regulations would not be
as current as the guidelines and more difficult to amend, if necessary.
One of the reasons APHIS included these provisions in the
regulations was to ensure that these categories of experiments are
conducted only if safe to do so. By including these provisions in the
regulations, we are providing notice to the public and establishing
enforceable regulatory requirements. APHIS would have difficulty
enforcing the provisions of the NIH Guidelines. If it becomes necessary
to revise the list of restricted experiments, we will initiate
rulemaking and provide notice and opportunity for public comment. For
these reasons, we are making no change based on this comment.
A commenter suggested that the NIH recombinant advisory committee
be designated to review the restricted experiments.
We do not believe it is necessary to designate the NIH recombinant
advisory committee to review applications to conduct restricted
experiments. The Administrator of APHIS will approve such experiments
after consultation with subject matter experts and, for overlap select
agents and toxins, CDC. Accordingly, we are making no changes based on
this comment.
One commenter stated that interim 9 CFR 121.10(c)(1) (newly
designated Sec. 121.13(a)) is open to interpretation and, therefore,
needs to be more specific. This commenter also suggested that the
restricted experiment provisions should contain an exception for small
scale in vitro experiments.
We disagree that this provision needs to be more specific. However,
we note that additional guidance on the requirements for experiments
involving recombinant DNA may be obtained from APHIS or the NIH
Guidelines. We also disagree that the restricted experiment provisions
should contain an exemption for small scale in vitro experiments. APHIS
included these provisions in the regulations to ensure that these
experiments are conducted only if safe to do so. The commenter provided
no information to indicate that small scale in vitro experiments are
safe and, therefore, should be exempted from the restricted experiment
provisions. Accordingly, we are making no changes in response to this
comment.
A commenter stated that an entity utilizes the deliberate formation
of antibiotic resistance as a common research tool and that the
restricted experiments provisions will limit this standard research
practice. The commenter noted that transposon insertion libraries are
common experimental creations used to generate gene knockouts and study
the effect on expression and phenotype; however, this often results in
an array of genomes containing antibiotic resistance markers used for
selection and screening. The commenter argued that this common practice
should not need approval and that it is too burdensome on the entity to
obtain approval for each of several thousand insertional mutants that
would be created for a single genome.
As previously noted, APHIS included these provisions in the
regulations to ensure that these experiments are conducted only if safe
to do so. We believe the manipulation of a select agent in order to
create antibiotic resistance increases the risks to human, animal, or
plant health and, therefore, warrants APHIS' approval. We are making no
change based on this comment.

Incident Response

In interim 7 CFR 331.11(a)(3) and 9 CFR 121.12(a)(3), we required
that the Biocontainment and Security Plan/Biosafety and Security Plan
include incident response plans for containment breach, security
breach, inventory violations, non-biological incidents such as
workplace violence, and cybersecurity breach. These plans were required
to address personnel safety and health, containment, inventory control,
and notification of managers and responders. In addition, the plans
were required to address bomb threats, severe weather (floods,
hurricanes, tornadoes), earthquakes, power outages, and other natural
disasters or emergencies.
A commenter stated that the requirements for APHIS' incident
response plan and CDC's emergency response plan should be the same.
We agree. Therefore, the revised incident response sections in this
final rule (newly designated 7 CFR 331.14 and 9 CFR 121.14) are
consistent with the incident response section in CDC's final rule. In
this final rule, we are adding the CDC requirement that an incident
response plan must be coordinated with any entity-wide plans. To ensure
that such plans are available for review by an entity's employees, we
are also requiring that the plans be kept in the workplace and made
available to employees for review. In addition, as described below in
response to a request for clarification of the term ``incidents,'' we
are clarifying the types of incidents and information that must be
included in the plan. Finally, we are adding the CDC requirement that
the response procedures account for the hazards associated with the
select agent or toxin and appropriate actions to contain such agent or
toxin.
A commenter requested clarification of the term ``incidents.'' In
this final rule, newly designated 7 CFR 331.14 and 9 CFR 121.14 require
that the incident response plan fully describe the entity's response
procedures for theft, loss, or release of a select agent or toxin,
inventory discrepancies, security breaches (including information
systems), severe weather and other natural disasters, workplace
violence, bomb threats and suspicious packages, and emergencies such as
fire, gas leak, explosion, power outage, etc.
One commenter stated that the reference to ``inventory control'' is
ambiguous and needs to be defined.
We agree that the term ``inventory control'' is not clear.
Therefore, we are deleting the reference to inventory control in this
final rule. However, we are retaining the requirement that an incident
response plan describe the entity's response procedures for inventory
discrepancies.

Training

Interim 7 CFR 331.12 (newly designated Sec. 331.15) required the
responsible official to provide appropriate training in containment and
security procedures to all individuals with access to listed agents and
toxins,

[[Page 13266]]

while interim 9 CFR 121.13 (newly designated Sec. 121.15) required the
responsible official to provide appropriate training in biosafety,
containment, and security procedures to all individuals with access to
listed agents and toxins. Both sections required the responsible
official to provide information and training to an individual at the
time the individual is assigned to work with a listed agent and toxin,
and to provide refresher training annually.
A commenter requested clarification about the training
requirements. This commenter wondered what would be considered
appropriate training, what qualifications an individual would need to
train others, and who decides if the training is adequate. Another
commenter recommended that APHIS revise the training provisions to
require training for approved individuals working with select agents
and toxins and unapproved individuals working in or visiting areas
where select agents and toxins are handled or stored. The commenter
suggested that such training may be modified according to the needs of
the individual, the work they will do, and their potential exposure. A
commenter noted that APHIS' training requirements cover fewer staff
than CDC's training requirements (i.e., only those individuals handling
the agents or toxins). The commenter recommended that the APHIS and CDC
requirements be consistent.
In response to these comments, in this final rule we are amending
both sections to require that an individual or entity provide
information and training on biocontainment/biosafety and security to
each individual with access approval from the Administrator or the HHS
Secretary before he/she has such access (newly designated 7 CFR
331.15(a) and 9 CFR 121.15(a)). We are also requiring that an
individual or entity provide training to each individual not approved
for access by the Administrator or the HHS Secretary before he/she
works in or visits areas where select agents or toxins are handled or
stored (e.g., laboratories, growth chambers, animal rooms, greenhouses,
storage areas, etc.). The training must address the particular needs of
the individual, the work they will do, and the risks posed by the
select agents or toxins. Finally, refresher training must be provided
annually (newly designated 7 CFR 331.15(b) and 9 CFR 121.15(b)). These
changes will make the APHIS and CDC regulations consistent. We note the
training should be provided by an individual who has the appropriate
training and skills. APHIS will determine if an individual's training
is adequate.
One commenter recommended that APHIS adopt the CDC provisions in
interim 42 CFR 73.13(d) that allows an entity to certify that personnel
have been trained.
In interim 42 CFR 73.13(d), CDC provided that, in lieu of initial
training for those individuals already involved in handling select
agents or toxins, the responsible official may certify that an
individual has the required knowledge, skills, and abilities to safely
carry out the duties and responsibilities. CDC included this provision
to minimize the disruption of research or educational projects that
were under way as of the effective date of the December 2002 interim
rule. CDC is deleting this provision in its final rule. For this
reason, we are making no change based on this comment.

Transfer of Biological Agents and Toxins

Interim 7 CFR 331.13 and 9 CFR 121.14 (newly designated 7 CFR
331.16 and 9 CFR 121.16) set out the transfer requirements and
procedures. In this final rule, we are amending newly designated 7 CFR
331.16 and 9 CFR 121.16 to clarify the transfer provisions.
Specifically, we are amending both sections by providing that, in
addition to any permit required under the regulations, a transfer of a
select agent or toxin may be authorized if: (1) The sender has a
certificate of registration that covers the agent or toxin to be
transferred and meets the requirements of each part, meets the
exemption requirements for the select agent or toxin to be transferred,
or is transferring the select agent or toxin from outside of the United
States and meets all import requirements, and (2) at the time of
transfer, the recipient has a certificate of registration that includes
the select agent or toxin to be transferred and meets all of the
requirements of each part (newly designated 7 CFR 331.16(b) and 9 CFR
121.16(b)). This information was contained in the interim rule but the
final rule more clearly sets out the requirements for the sender and
recipient. We are also amending the transfer provisions in 9 CFR 121.16
to provide that a select agent or toxin contained in a specimen for
proficiency testing may be transferred without prior authorization from
APHIS or CDC provided that, at least 7 calendar days prior to the
transfer, the sender reports to APHIS or CDC the select agent or toxin
to be transferred and the name and address of the recipient. This
change, in conjunction with the reporting requirements for
identifications of select agents or toxins in 9 CFR 121.5, 121.6, and
121.9, will allow us to more effectively monitor proficiency testing
activities.
In addition, we are amending both sections to provide that the
recipient must immediately notify APHIS or CDC if a package containing
a select agent or toxin has been damaged to the extent that a release
of the select agent or toxin may have occurred (newly designated 7 CFR
331.16(f) and 9 CFR 121.16(g)). These changes will make the APHIS and
CDC regulations consistent.
Both sections (newly designated 7 CFR 331.16(g) and 9 CFR
121.16(h)) also provide that an authorization for a transfer shall be
valid only for 30 calendar days after issuance, except that such an
authorization becomes immediately null and void if any facts supporting
the authorization change (e.g., change in the certificate of
registration for the sender or recipient, change in the application for
transfer). This change is intended to ensure timely transfers of select
agents and toxins and provide notice to the public that APHIS may
terminate a transfer authorization under certain circumstances.
One commenter stated that the regulations should provide for
transfer of agents and toxins from an unregistered entity to a
registered entity to prevent destruction of valuable historical,
archival, and educational materials.
We agree. Accordingly, in this final rule, we are amending the
transfer provisions in interim 7 CFR 331.13 and 9 CFR 121.14 to provide
that, on a case-by-case basis, the Administrator may authorize a
transfer of a select agent or toxin, not otherwise eligible for
transfer under each part, under conditions prescribed by the
Administrator (newly designated 7 CFR 331.16(c) and 9 CFR 121.16(c)).
One commenter maintained that APHIS should permit hand-carried
transfers of select agents or toxins with the same reporting
requirements already described in the regulations.
Given the risks posed by select agents and toxins, we do not
believe that hand-carried transfers of such agents or toxins is
consistent with the intent of the Act. By prohibiting hand-carried
transfers, we ensure that select agents or toxins are packaged
appropriately and that there is documentary evidence of the transfer
(e.g., tracking numbers, confirmation of delivery, etc). We are making
no changes based on this comment.
One commenter stated that the requirement that APHIS or CDC approve
transfers between entities is highly likely to produce unreasonable
delays. The commenter suggested that the

[[Page 13267]]

regulations be revised to require that APHIS respond within an
appropriate interval (e.g., 1 to 2 days).
We do not expect the transfer requirements in the regulations to
produce unreasonable delays. The requirement for approval prior to a
transfer of a select agent or toxin is not a new requirement, nor is it
unreasonable given the risks posed by select agents or toxins. The
transfer requirements for select agents and toxins incorporate the
permit requirements under the plant pest regulations in 7 CFR part 330
and the organisms and vectors regulations in 9 CFR part 122, which
require APHIS' approval prior to transfer. We are making no changes
based on this comment.
A commenter asserted that the transfer provisions are incompatible
with biosecurity. The commenter stated that they require the principal
investigator to prohibit access to the material up to the point of
shipment, after which the package is handled by a host of individuals
out of the control of the responsible official or the principal
investigator. Several commenters expressed concern about the U.S.
Department of Transportation's labeling requirements for packages
containing select agents or toxins. These commenters pointed out that
the labeling requirements clearly indicate which packages should be
stolen. One commenter recommended eliminating the requirement for
external labeling. This commenter also recommended adding tamper-
indicating procedures in the packaging so that the recipient would know
the package had been tampered with.
These issues are outside the scope of this rulemaking. Accordingly,
we are making no changes based on these comments.

Records

Interim 7 CFR 331.14 and 9 CFR 121.15 required the responsible
official to maintain complete, up-to-date records of information
necessary to give an accounting of all of the activities related to
listed agents and toxins. Such records must be maintained for 3 years
and produced upon request to APHIS inspectors and appropriate Federal,
State, and local law enforcement authorities.
A commenter stated that the requirements for inventory records of
select agents are unclear. The commenter pointed out that research labs
generate and destroy material on a daily, if not hourly, basis. The
commenter wondered if the inventory requirement pertained to stock
collections or to all infectious materials generated. Another commenter
stated that keeping track of vials is a waste of Federal resources.
We agree that the requirements for inventory records are unclear.
To provide clarification and to be consistent with CDC's approach, in
this final rule the inventory recordkeeping requirements in both parts
(newly designated 7 CFR 331.17 and 9 CFR 121.17) require the
maintenance of an accurate, current inventory for each select agent
held in long-term storage (placement in a system designed to ensure
viability for future use, such as in a freezer or lyophilized
materials) and for each toxin held. The provisions for select agents
and toxins are different to account for the differences between select
agents and toxins; we do not believe it is feasible to record
quantities of replicating organisms (i.e., select agents). In addition,
we are providing more information about the types of information that
must be included in the inventory records for each select agent or
toxin. For example, an inventory for a select agent must include the
name and characteristics of the agent, the quantity acquired from
another entity, where stored, when moved from storage and by whom,
purpose of use, transfer records, etc., while an inventory for a toxin
must include the name and characteristics of the toxin, the quantity
acquired from another entity, the initial and current quantity, where
stored, when moved from storage and by whom, transfer records, etc.
Interim 7 CFR 331.14(a)(4) and 9 CFR 121.15(a)(4) required an
individual or entity to maintain accurate and current inventory records
(including source and characterization data).
One commenter recommended that APHIS define the terms
``characterization data'' and ``accurate.'' To clarify the term
``characterization data,'' in this final rule we are providing examples
of the characterization information that should be maintained by the
entity for each select agent (e.g., strain designation, GenBank
Accession number, etc.). The term ``accurate'' is commonly defined as
free from mistakes or errors. We do not believe it is necessary to
define this term in the regulations.
A commenter suggested that all records should be marked and
protected at the ``Official Use Only'' level.
To be consistent with CDC's regulations, in this final rule newly
designated 7 CFR 331.17 and 9 CFR 121.17 require an entity to implement
a system to ensure that all records and databases created under each
part are accurate, have controlled access, and can be verified for
authenticity. We do not believe it is necessary to require that an
entity mark and protect all of its records at the ``Official Use Only''
level to satisfy this requirement. Therefore, we are not implementing
this suggestion.
One commenter suggested that all transfer forms be securely stored
for 5 years, instead of 3 years. Taking into consideration the burden
on the public and APHIS' investigational needs, we believe that it is
reasonable to require that all records, including transfer forms, be
maintained for 3 years. Accordingly, we are making no change based on
this comment.

Inspections

Interim 7 CFR 331.15(a) provided that any APHIS inspector must be
allowed, without previous notification, to enter and inspect the entire
premises, all materials and equipment, and all records required to be
maintained by the regulations, while interim 9 CFR 121.16(a) contained
a similar provision for APHIS or CDC inspectors.
To be consistent with CDC's regulations, newly designated 7 CFR
331.18(a) and 9 CFR 121.18(a) provide that APHIS, without prior
notification, must be allowed to inspect any site at which activities
regulated under each part are conducted and must be allowed to inspect
and copy any records relating to the activities covered under each
part.
Interim 7 CFR 331.15(b) provided that, prior to issuing a
certificate of registration, APHIS may inspect and evaluate the
premises and records to ensure compliance with the regulations and the
biosafety, containment and security requirements. Interim 9 CFR
121.16(b) contained a similar provision for APHIS or CDC inspectors.
In this final rule, we are removing the phrase ``and the
containment and security requirements'' (newly designated 7 CFR
331.18(b)) and removing the phrase ``and the biosafety, containment,
and security requirements'' (newly designated 9 CFR 121.18(b)). These
phrases are unnecessary since we already state in both sections that,
prior to issuing a certificate of registration, APHIS may inspect and
evaluate an entity's premises and records to ensure compliance with the
regulations.
A commenter requested additional information about compliance
inspections. In particular, the commenter asked what level of training
and security clearances would be required for inspectors and whether
there would be separate inspectors to

[[Page 13268]]

assess the biosafety and security requirements. The commenter also
asked what standards will be used by the inspectors to assess
compliance with the regulations.
APHIS inspectors will have the appropriate training and security
clearances (at least a security risk assessment) to inspect and
evaluate an entity's premises and records to ensure compliance with the
regulations. APHIS inspectors will use the standards established in the
regulations and published guidelines (e.g., BMBL) to determine
compliance. While we expect that, normally, only one inspector will be
needed to conduct an inspection, occasionally more than one inspector
may be needed to evaluate an entity's biosafety, containment, and
security.
APHIS and CDC will coordinate inspections to minimize the burden on
the entity. This coordination will ensure that inspections by APHIS and
CDC are not duplicative. However, additional inspections may be
required under certain circumstances. For instance, another inspection
may be required for amendments to a certificate of registration (e.g.,
addition of a laboratory) or to satisfy APHIS' permit requirements.

Notification in the Event of Theft, Loss, or Release

Interim 7 CFR 331.16(a) and 9 CFR 121.17(a) required the
responsible official to orally notify APHIS and appropriate Federal,
State, or local law enforcement agencies immediately upon discovery of
a theft or loss of listed agents or toxins. We also required that the
oral notification be followed by a written report within 7 days. In
this final rule, newly designated 7 CFR 331.19(a) and 9 CFR 121.19(a)
provide that thefts or losses must be reported to APHIS or CDC. In
addition, these paragraphs clarify that thefts or losses must be
reported even if the select agent or toxin is subsequently recovered or
the responsible parties are identified. These changes will make the
APHIS and CDC regulations consistent. Finally, we are specifying the
information that must be reported to APHIS or CDC (newly designated 7
CFR 331.19(a) and 9 CFR 121.19(a)). We believe this change will clarify
the requirements for notification of theft or loss of select agents and
toxins.
Interim 7 CFR 331.16(b) and 9 CFR 121.17(b) provided that the
responsible official must orally notify APHIS immediately upon
discovery that a release of a listed agent or toxin has occurred
outside the biocontainment area. We also required that the oral
notification of a release be followed by a written report within 7
days. The regulations further provided that APHIS will notify relevant
Federal, State, and local authorities, and the public, if necessary. In
Sec. 121.17(b), we additionally provided that, if the release involves
an overlap agent or toxin, we will also notify the Secretary of Health
and Human Services.
In this final rule, newly designated 7 CFR 331.19(b) requires that
APHIS or CDC be notified immediately upon discovery of a release of a
PPQ select agent or toxin outside the primary barriers of the
biocontainment area while 9 CFR 121.19(b) requires that APHIS or CDC be
notified immediately upon discovery of a release of a VS or overlap
select agent or toxin causing occupational exposure or a release
outside the primary barriers of the biocontainment area. The
requirement for notification of a release outside of the primary
barriers of the biocontainment area is a clarification. This is how we
have always interpreted the provision regarding release outside the
biocontainment area; however, we are making this change to make it
clear to the public. In 9 CFR 121.19(b), we are adding the provision
for occupational exposure to be consistent with CDC's regulations. We
did not include this provision in 7 CFR 331.19 because PPQ select
agents and toxins do not pose a severe threat to human health and,
therefore, it is unnecessary to address personnel safety and health. In
both sections, we are also specifying the information that must be
reported to APHIS or CDC. We believe these changes will clarify the
requirements for notification of a release.
Finally, we are deleting the provision that APHIS will notify
relevant Federal, State, and local authorities, and the public in the
event a release poses a threat to animal health or animal products.
This is an administrative action taken by APHIS and it is unnecessary
to include this information in the regulations.
A commenter requested clarification of the term ``unintentional
release.'' The commenter stated that it can be interpreted to include
any exposure or release at any biosafety level.
The term ``unintentional release'' is not used in either the
interim regulations or this final rule. Therefore, we are making no
change based on this comment.
Several commenters urged APHIS to exempt from notification those
accidents (i.e., releases) that take place entirely within biosafety
labs where the select agent is being handled at the appropriate
biosafety level. One commenter went on to state that an exposed worker
may be so concerned about needing to report an accident to APHIS that
he or she may decide not to inform anyone of a potential exposure,
resulting in an immediate risk to the person and a possible risk to the
population.
Given the risks associated with select agents and toxins, we
believe it is necessary to be notified of all occupational exposures.
It is the entity's responsibility to ensure that its employees comply
with these reporting requirements. For these reasons, we are making no
changes based on these comments.

Administrative Review

Interim 7 CFR 331.17 and 9 CFR 121.18 provided that an individual
or entity may appeal a denial or revocation of registration. In
addition, these sections provided that an individual who has been
denied access to listed agents or toxins or who has been granted only
limited access to listed agents or toxins may appeal that decision.
Both sections set out the process for an administrative review.
In this final rule, the administrative review sections also provide
that an individual or entity may appeal the suspension of registration.
This provision was included in the sections on denial, revocation, and
suspension of registration (interim 7 CFR 331.7 and 9 CFR 121.8) but
was inadvertently not included in interim 7 CFR 331.17 and 9 CFR 121.18
(newly designated 7 CFR 331.20 and 9 CFR 121.20). In addition, we are
amending both sections to allow an individual to appeal revocation of
access approval. This change corresponds to a change in newly
designated 7 CFR 331.10 and 9 CFR 121.10 that allows revocation of an
individual's access approval in the event that an individual becomes a
restricted person under 18 U.S.C. 175b or is reasonably suspected by
any Federal law enforcement or intelligence agency of committing a
crime set forth in 18 U.S.C. 2332b(g)(5), knowing involvement with an
organization that engages in domestic or international terrorism (as
defined in 18 U.S.C. 2331) or with any other organization that engages
in intentional crimes of violence, or being an agent of a foreign power
as defined in 50 U.S.C. 1801.
A commenter stated that the final rule should include provisions
for entities and individuals to appeal security risk assessment
decisions or seek exemptions for legitimate research.
The regulations already allow an individual who has been denied
access to select agents or toxins or who has been granted only limited
access to such

[[Page 13269]]

agents or toxins to appeal that decision (interim 7 CFR 331.17 and 9
CFR 121.18; newly designated 7 CFR 331.20 and 9 CFR 121.20). However,
in accordance with the Act, an entity may not appeal the denial or
limitation of an individual's access to select agents or toxins. The
regulations do not provide exemptions for research. However, we note
that an individual's access to PPQ select agents or toxins and VS
select agents or toxins may be limited or denied if an individual is a
restricted person under 18 U.S.C. 175b. In addition, an individual's
access to PPQ select agents or toxins, VS select agents or toxins, or
overlap select agents or toxins may be limited or denied if an
individual is reasonably suspected by any Federal law enforcement or
intelligence agency of committing a crime set forth in 18 U.S.C.
2332b(g)(5), knowing involvement with an organization that engages in
domestic or international terrorism (as defined in 18 U.S.C. 2331) or
with any other organization that engages in intentional crimes of
violence, or being an agent of a foreign power as defined in 50 U.S.C.
1801. For these reasons, we are making no changes based on this
comment.

Miscellaneous

We are also making minor, nonsubstantive changes to the regulations
to correct misspellings and internal references, reflect changes to the
form numbers, ensure a consistent format in both parts, and eliminate
redundancy.
Therefore, for the reasons given in the interim rule and in this
document, we are adopting the interim rule as a final rule, with the
changes discussed in this document.
This final rule also affirms the information contained in the
interim rule concerning Executive Orders 12372 and 12988.

Effective Date

For the reasons discussed in the Supplementary Information section
of this rule, we have determined that it is no longer necessary to
include Phakopsora pachyrhizi (Asian soybean rust) and plum pox
potyvirus on the list of PPQ select agents and toxins. Therefore, this
final rule amends 7 CFR 331.3(b) by removing P. pachyrhizi and plum pox
potyvirus from that list. Making these amendments to 7 CFR 331.3(b)
effective immediately will relieve restrictions we no longer find
warranted and aid ongoing research into effective means of managing
Asian soybean rust in the United States. Pursuant to the provisions of
5 U.S.C. 553, we have determined that this aspect of the final rule
relieves restrictions and thus may be made effective less than 30 days
after publication in the Federal Register. Accordingly, the
Administrator of the Animal and Plant Health Inspection Service has
determined that the amendments made to 7 CFR 331.3(b) in this rule
should be effective upon signature. The remaining provisions of this
final rule will become effective 30 days after date of the rule's
publication in the Federal Register.

Executive Order 12866 and Regulatory Flexibility Act

This rule has been reviewed under Executive Order 12866. The rule
has been determined to be significant for the purposes of Executive
Order 12866 and, therefore, has been reviewed by the Office of
Management and Budget.
For this rule, we have prepared an economic analysis. The economic
analysis provides a cost-benefit analysis, as required by Executive
Order 12866, as well as an analysis on the potential economic effects
of this final rule on small entities, as required under 5 U.S.C. 603.
The economic analysis is summarized below. Copies of the full analysis
are available by contacting the person listed under FOR FURTHER
INFORMATION CONTACT.

Background

Certain pathogens or toxins produced by biological organisms that
are released intentionally or accidentally can result in disease, wide-
ranging and devastating impacts on the economy, disruption to society,
diminished confidence in public and private institutions, and large-
scale loss of life.
The Public Health Security and Bioterrorism Preparedness and
Response Act of 2002 (Pub. L. 107-188), provides for the regulation of
certain biological agents \1\ and toxins \2\ that have the potential to
pose a severe threat to public health and safety, to animal health, to
plant health, or to animal and plant products. The Act also requires
that the Secretary of Agriculture establish and enforce standards and
procedures governing the possession and use of the listed biological
agents and toxins, including the establishment and enforcement of
safety requirements for the transfer of listed agents and toxins; the
establishment and enforcement of safeguard and security measures to
prevent access to listed agents and toxins for use in domestic or
international terrorism or other criminal purpose; and the
establishment of procedures to protect animal and plant health, and
animal and plant products, in the event of a transfer in violation of
the established safety and security measures. APHIS has the primary
responsibility for implementing the provisions of the Act within USDA.
VS select agents and toxins are those that have been determined to have
the potential to pose a severe threat to animal health or animal
products. PPQ select agents and toxins are those that have been
determined to have the potential to pose a severe threat to plant
health or plant products. Overlap select agents and toxins are those
that have been determined to pose a severe threat to public health and
safety, to animal health, or to animal products. Overlap select agents
and toxins are subject to regulation by both APHIS and CDC, which has
the primary responsibility for implementing the provisions of the Act
for the Department of Health and Human Services.
---------------------------------------------------------------------------

\1\ Any microorganism (including, but not limited to, bacteria,
viruses, fungi, rickettsiae, or protozoa), or infectious substance,
or any naturally occurring, bioengineered, or synthesized component
of any such microorganism or infectious substance, capable of
causing: (1) Death, disease or other biological malfunction in a
human, an animal, a plant, or another living organism; (2)
deterioration of food, water, equipment, supplies, or material of
any kind; or (3) deleterious alteration of the environment.
\2\ The toxic material or product of plants, animals,
microorganisms (including, but not limited to, bacteria, viruses,
fungi, rickettsiae, or protozoa), or infectious substances, or a
recombinant or synthesized molecule, whatever their origin and
method of production, and includes: (1) Any poisonous substance or
biological product that may be engineered as a result of
biotechnology produced by a living organism; or (2) any poisonous
isomer or biological product, homolog, or derivative of such a
substance.
---------------------------------------------------------------------------

Benefits of the Rule

This rule will require registration, biocontainment/biosafety,
incident response and security measures for the possession, use, and
transfer of the select agents and toxins listed in 7 CFR part 331 and 9
CFR part 121. This rule is intended to prevent the misuse of those
select agents and toxins, and will therefore reduce the potential for
those pathogens to harm humans, animals, animal products, plants or
plant products in the United States. Should any select agent or toxin
be intentionally introduced into the United States, the consequences
would be significant. Some of these select agents have the potential to
cause ailment and death in humans. Direct losses in agriculture could
occur as a result of the exposure, such as death or debility of
affected production animals, or yield loss in plants. Industry could
also be affected through the imposition of domestic and foreign
quarantines, which result in a loss of markets. The Federal and State
Governments would

[[Page 13270]]

also incur costs associated with eradication and quarantine enforcement
to prevent further spread, and in the case of intentional
introduction--law enforcement. In addition, there is the potential for
a disruption in the domestic food supply, whether through
contamination, consumer perception, or both. Past food safety incidents
have shown that consumer perceptions (both domestic and international)
about an implicated food product and about the producing country or
sector's ability to produce safe food are slow to recover and can have
a lasting influence on food demand and global trade.\3\ As such, the
benefits associated with the rule are the avoided losses to the animals
or plants that could be attacked by these organisms, and their products
and markets.
---------------------------------------------------------------------------

\3\ Buzby, J.C. Effects of food-safety perceptions on food
demand and global trade. Changing Structure of Global Food
Consumption and Trade/WRS-01-1. Economic Research Service/USDA.
---------------------------------------------------------------------------

The costs associated with outbreaks can be very high as is
demonstrated by natural outbreaks associated with select agents that
have occurred. For example, it has been estimated that the losses to
agriculture and the food chain from the recent foot-and-mouth disease
(FMD) outbreak in the United Kingdom (UK), including the costs
compensated by the government, amount to about [pound]3.1 billion ($4.7
billion). In 1999, it was estimated that the potential impacts of an
FMD outbreak in California alone would be between $8.5 and $13.5
billion.\4\ Also, a bovine spongiform encephalopathy (BSE) crisis
occurred in the UK (which has a cattle industry about one-tenth the
size of that in the United States) in 1996. It has been estimated \5\
that the total resource costs to the UK economy as a result of BSE in
the first 12 months after the onset of the 1996 crisis were in the
range of [pound]740 million to [pound]980 million ($1.2 billion to $1.5
billion), or just over 0.1 percent of the gross domestic product of the
United Kingdom. In addition to these losses, the UK lost its entire
export market for beef following the crisis.
---------------------------------------------------------------------------

\4\ Ekboir, J.M. Potential impact of foot-and-mouth disease in
California: the role and contribution of animal health surveillance
and monitoring services. Davis, CA: Agricultural Issues Center,
Division of Agriculture and Natural Resources, University of
California, Davis, 1999.
\5\ DTZ Pieda Consulting. Economic Impact of BSE on the UK
economy. A Report commissioned by the UK Agricultural Departments
and HM Treasury.
---------------------------------------------------------------------------

The above cited consequences relate to natural or accidental
introduction. Deliberate introduction greatly increases the probability
of an agent or toxin becoming established and causing wide-ranging and
devastating impacts on the economy, disruption to society, diminished
confidence in public and private institutions, and possible loss of
life. The perpetrators would have the advantage of controlling the time
of introduction of the agent, introducing agents into remote or highly
susceptible areas, multiple introductions of the same agent, or
simultaneous release of different agents. Intentional introductions
permit an increased probability of survival of a pathogen, the use of
highly virulent strains and high concentrations of inoculum, and
precise timing of release to coincide with maximal colonization
potential.\6\
---------------------------------------------------------------------------

\6\ National Research Council.
---------------------------------------------------------------------------

Costs of the Rule

The rule is intended to ensure that any entity that possesses, uses
or transfers a select agent or toxin is registered and has safeguard,
containment, and disposal requirements that are commensurate with the
risk of that agent or toxin. Affected entities vary widely, and
therefore, the biosafety/biocontainment, incident response and physical
security situation will vary widely from one entity to another, as will
the specific changes that will need to occur at a given entity to
comply with this rule.

Affected Entities

Entities that possess, use, or transfer VS, PPQ or overlap select
agents or toxins will be affected by this rule. Because of the nature
of some of these entities and some of the select agents or toxins they
possess, APHIS and CDC share common regulatory authority. However,
APHIS and CDC have established procedures that will allow an entity to
interact with only one agency--either APHIS or CDC--with respect to all
matters involving select agents and toxins. This analysis considers
only those entities for which APHIS is considered the primary
regulatory agency.\7\
---------------------------------------------------------------------------

\7\ Those entities for which the CDC is considered the primary
regulatory agency are considered in conjunction with the CDC rule.
---------------------------------------------------------------------------

The affected entities are primarily research and diagnostic
facilities. They include Federal, State, and university laboratories,
and private commercial and non-profit enterprises. Currently, there are
76 \8\ academic, commercial, State and Federal government facilities
that have applied for a certificate of registration from APHIS for PPQ,
VS, and/or overlap agents and toxins. Approximately 34 percent of these
entities are academic, 37 percent are private commercial enterprises,
28 percent are government, and 1 percent are non-profit.
---------------------------------------------------------------------------

\8\ Thus far, APHIS has received 148 applications for
registration or exemption. Of those, 72 were exempt, have been
shifted to CDC, been withdrawn, or denied.
---------------------------------------------------------------------------

The level of security at the entities that possess, use or transfer
select agents and toxins is currently very diverse, ranging from a
locked freezer to a lock on the door to razor wire perimeter fencing, a
guard post, locks or coded entry, and visitor escorts.

Exemptions and Exclusions From the Rule

A number of exclusions and exemptions from the rule exist that
reduce the number of entities that otherwise might have been affected
by this rule. For example, nonviable select agents and nonfunctional
toxins are excluded from the requirements of this rule. Some attenuated
strains of a select agent or toxin may be excluded based on a
determination that the strain does not pose a severe threat to animal
health or to animal products. In addition, overlap toxins are excluded
if they are under the control of a principal investigator, treating
physician or veterinarian, or commercial manufacturer or distributor
and the aggregate amount does not, at any time, exceed certain amounts.
In addition, a number of exemptions also exist. In particular,
exemptions cover diagnostic laboratories and others when select agents
and toxins contained in a specimen are presented for diagnosis or
verification and proficiency testing. Diagnostic reagents and vaccines
that are, bear, or contain VS select agents or toxins that are produced
at USDA diagnostic facilities are also exempt from the requirements.
For the most part, products that are, bear, or contain VS or overlap
select agents or toxins are exempt from the requirements if the
products have been cleared, approved, licensed, or registered under a
number of Federal statutes. Experimental products and investigational
products can also be exempted.
In addition, the Administrator may grant exemptions from the
applicability of the regulations as they apply to VS or PPQ select
agents and toxins if the Administrator determines that such exemptions
are consistent with protecting animal or plant health, or animal or
plant products. While an entity will not be exempt if it keeps a
positive control of a select agent or toxin, alternatives will exist.
If an entity decides to keep a positive control of a select agent or
toxin, it will have to register and may need to make changes to its
operations in order to do so.
Those not specifically exempted have to submit an exemption
application if

[[Page 13271]]

they wish to become exempt. Thus far, APHIS has received 34 exemption
applications, and anticipates receiving an additional one per year. It
is estimated that applying for an exemption requires 1.17 hours (0.17
managerial hours at $86.09 per hour \9\, and 1 technical hour at $69.34
per hour), or $84 per exemption application. Based on the number of
exemption applications received, the total initial cost is estimated to
have been $2,900, while the yearly cost for new applicants would be
about $100. Exemptions are valid for a maximum of 3 years; therefore
the costs of applying for an exemption would recur every 3 years.
---------------------------------------------------------------------------

\9\ For purposes of this analysis we use estimates of an average
hourly respondent labor rate (including fringe and overhead) of
$86.09 for managerial staff, and $69.34 for technical staff. Based
on the 2000 Occupational Employment Statistics Survey, Bureau of
Labor Statistics.
---------------------------------------------------------------------------

Remaining exempt under this rule will require the submission of the
proper paperwork dealing with identifications and the transfer or
destruction of select agents and toxins. Registered diagnostic
laboratories will also be required to report identifications of select
agents and toxins when presented for diagnosis. The number of these
identifications can vary widely in a given year, climbing dramatically
when outbreaks occur. However, during agricultural emergencies or
outbreaks, or in endemic areas, the Administrator may require less
frequent reporting. APHIS expects to receive an average of 1,000
notifications of identifications from diagnostic laboratories in a
given year. It is estimated that complying with the notification
requirements will require 1 hour (0.17 managerial hours and 0.83
technical hours), or $72 per notification. Based on 1,000
notifications, the estimated total cost is $72,000 per year.

Registration

Under this rule, unless exempted an individual or entity shall not
possess, use, or transfer any select agent or toxin without a
certificate of registration issued by APHIS or CDC. The registration
process is designed to obtain critical information concerning
individuals or entities in possession of certain agents or toxins, as
well as the specific characteristics of the agents and toxins.
Information to determine that individuals and entities seeking to
register have a lawful purpose to possess, use, or transfer agents or
toxins will also be required as part of the registration process. This
will involve security risk assessments by the Criminal Justice
Information Services (CJIS) Division of the Federal Bureau of
Investigation, and collecting and providing the required information.
The checks will require that individuals provide identifying
information. In addition, this information will need to include
fingerprints. It is estimated that this cost will be $5 to $30 per set
for those done on paper. It may cost up to $50 per set for electronic
prints, but these could be processed far more quickly. A given entity
could expect to spend between $50 and $5000 obtaining and submitting
fingerprints, with between 10 and 100 employees needing fingerprints
per entity. To the extent that there is staff turnover at an entity,
these costs could be recurring. With a total of 2,300 security risk
assessments to be performed initially, and an average fingerprinting
cost of $27.50 per individual, the total cost of obtaining fingerprints
would be $63,250. With 1,300 new assessments to be performed yearly,
the annual cost of obtaining fingerprints could be expected to be
$37,750. APHIS may request the Attorney General to expedite an
individual's security risk assessment upon request by the responsible
official and a showing of good cause. APHIS expects to receive 20 of
these requests initially and 13 a year thereafter. These requests are
expected to take 0.5 managerial hours, or $43 per occurrence. This
gives a total cost of $1,000 in the first year, and $560 a year
thereafter.
It is estimated that it will take a total of 3 managerial hours and
0.75 technical hours for a complete form with one principal
investigator (PI) plus 0.75 technical hours per additional PI. Affected
entities have between 1 and 9 PIs.\10\ It is, therefore, estimated to
take 3 managerial hours and between 0.75 and 6.75 technical hours to
complete the registration package, at a cost of between $310 and $726
per entity. Based on the number of PIs at the 76 entities currently
applying for registration, the total cost of registration is estimated
to be $29,000. APHIS expects to receive 8 new applications for
registration in a given year, with a total cost of $3,300 per year. It
is estimated that 75 percent of entities will amend their registrations
twice in a given year. These amendments are estimated to take 1
managerial hour, or $86 per amendment. Based on 76 registrations this
gives a cost of $9,800. In addition, because registrations will be
valid for up to 3 years, re-application will be required.\11\ It is
estimated that re-applying for registration will require 3 hours with
one PI (2.67 managerial hours and between 0.33 and 2.97 technical
hours) or $253 to $436 per entity to collect and provide the required
information. The total cost of re-application is estimated at $21,000
every 3 years based on the 76 entities currently applying for
registration, and the number of PIs at the entities.
---------------------------------------------------------------------------

\10\ Based on information from the registration applications, 40
percent of the registered entities have 1 PI, 30 percent have 2 PIs,
11 percent have 3 PIs, 6 percent have 4 PIs, 3 percent have 5 PIs, 3
percent have 6 PIs, 3 percent have 7 PIs, and 1 percent have 9 PIs.
\11\ To minimize the administrative burden associated with this
new registration program, initially APHIS will assign expiration
dates ranging from 24 to 36 months to stagger the dates for renewing
registration. Upon renewal, it is expected that all certificates of
registration will be valid for 3 years.
---------------------------------------------------------------------------

As a condition of registration, an individual or entity must
develop and implement a written security plan that provides graded
protection in accordance with the risk of the select agent or toxin,
given its intended use. The plan must describe inventory control
procedures, physical security and information systems control. The
individual or entity must also develop and implement a written
biosafety/biocontainment plan that is commensurate with the risk of the
agent or toxin, given its intended use. It is estimated that the
development of the biosafety/biocontainment plan may take 20 managerial
hours and 40 technical hours at a given entity for a cost of $4,500.
However, many entities will already have this type of plan in place and
in writing. For example, under the plant pest permit system, standard
operating procedures at an entity are already required to be submitted.
Also, university safety officers generally require that safety
requirements be in writing. If we conservatively assume that one-half
of the 76 affected entities need to develop these plans the total cost
would be $171,000. The development of the physical security plan would
most likely take place as a part of the site-specific entity security
assessment required under the rule (see Security).
As a further condition of registration, an individual or entity
must develop and implement a written incident response plan. The
incident response plan must fully describe the entity's response
procedures for releases, theft or loss of a select agent or toxin,
inventory discrepancies, security breaches (including information
systems), severe weather and other natural disasters, workplace
violence, bomb threats and suspicious packages, and emergencies such as
fire, gas leak, explosion, power outage, etc. The response procedures
must account for hazards associated with the select agent

[[Page 13272]]

or toxin and appropriate actions to contain such agent or toxin. It is
estimated that the development of the incident response plan may take
10 managerial hours and 25 technical hours at a given entity for a cost
of $2,600. However, many entities will already have similar plans in
place and in writing, i.e., as part of compliance with health and
safety regulations. If we conservatively assume that one-half of the 76
affected entities need to develop these plans, the total cost would be
$99,000.

Transfer

Under this rule, select agents and toxins may only be transferred
to individuals or entities registered to possess, use, or transfer that
particular agent or toxin. However, the sender may be an individual or
entity exempt from the requirements of this rule, or an individual or
entity located outside the United States. In addition, APHIS may
authorize transfers for select agents or toxins that would not
otherwise be eligible for transfer. Transfer must occur only with prior
authorization, notification of receipt by the recipient, and
notification of overdue or damaged shipments. APHIS expects there to be
a total of 130 transfers in a given year. It is estimated that
complying with the transfer requirements will require 1.75 hours (0.17
managerial hours and 1.58 technical hours), or $124 for each transfer.
This gives a total cost of $16,000 per year.

Biosafety/Biocontainment

Biosafety and containment requirements ensure that the combination
of work practices and physical containment are designed to reduce the
risks of working with infectious material and the degree of protection
is proportional to the risk associated with the agent. Higher biosafety
levels (BSL) correspond to greater degrees of protection. For example,
at a BSL-3 laboratory, more emphasis is placed on primary and secondary
barriers to protect personnel in contiguous areas, the community, and
the environment from exposure to potentially infectious aerosols. Also,
because there is special concern for reducing the risk of environmental
exposure to pathogens of concern to agriculture, BSL-3-Ag adds
filtration of supply and exhaust air, sewage decontamination, exit
personnel showers, and entity integrity testing. While the BSL
terminology is not formally used in relation to laboratories working
with plant agents or toxins, a parallel philosophy of matching pest
risk to biocontainment is used in the plant pest permit system. Under
this rule, the biosafety and containment procedures at an entity must
be sufficient to contain the agent or toxin (e.g., physical structure
and features of the entity, and operational and procedural safeguards).
Acquiring adequate biosafety and containment measures can be
costly. For example, as a result of work related to anthrax testing at
APHIS' National Veterinary Services Laboratories, a portion of the
laboratories' air handling system had to be replaced at a cost of
$75,000. However, the biosafety and containment requirements contained
in this rule should require little change at affected entities. USDA
permits \12\ cover the importation and interstate movement of agents
and toxins. Prior to the implementation of the December 2002 interim
rule, these permits already required the biosafety and containment
level to be commensurate with the risk associated with the pathogen
covered in the permit. Therefore, to the extent that affected entities
are already permittees, the biosafety and containment requirements in
this rule will have already been required at those entities. Before the
enactment of the Act, there may have been entities operating legally
outside the permit system, but who are not exempt from this rule. The
rule may involve additional biosafety or containment burdens for those
entities, but the extent of these burdens cannot be estimated.
---------------------------------------------------------------------------

\12\ Prior to the enactment of the Public Health Security and
Bioterrorism Response Act of 2002, USDA issued permits for
importation and interstate movement of agents and toxins, including
those now listed in 7 CFR part 331 and 9 CFR part 121.
---------------------------------------------------------------------------

Security

The rule will require that any entity where select agents and
toxins are held adequately provide for the physical security of the
premises. These requirements are intended to ensure the appropriate
levels of protection against, theft or loss of select agents or toxins,
and other acts that may cause unacceptable adverse impacts on national
security or on the health of the public or the environment. The
security systems and standard operating procedures must be sufficient
to safeguard the select agent or toxin against unauthorized access,
theft, or loss. The security systems and standard operating procedures
must be designed according to a site-specific risk assessment and must
provide graded protection in accordance with the risk of the select
agent or toxin, given its intended use.
The costs of providing security at entities where the select toxins
and agents are held can be considerable. USDA has recently upgraded, or
is currently upgrading, security at a number of its own entities,
including laboratories. While these costs are not a result of this
rule, they are illustrative of the spending that can be necessary to
upgrade security. By department policy, all USDA biosafety level 3
(BSL-3) laboratories are required to meet physical security
requirements. The level of security mandated in this policy meets or
exceeds the levels required in this rule. For example, upgrades at NVSL
in Ames, IA were completed in 2002 at a cost of $550,077 ($6.63/ft2,
83,000ft 2 total area). Installations of electronic security
components can include closed circuit television (CCTV) (cameras, VCR,
and control equipment), intrusion detection system (IDS) (access-
control card-readers, card-keys, operating computer and software), all
cabling associated with the security system, and integrating the system
with the off-site monitoring. Other security related expenses that
could be needed at a given entity following an entity security
assessment include entry control equipment (x-ray, metal detectors).
Other features would entail yearly recurring costs (i.e., off-site
monitoring, an equipment maintenance agreement, and guard service).
The security systems and standard operating procedures must be
designed according to a site-specific risk assessment. This site-
specific risk assessment is completed to determine the existing
security status and needs of a specific entity. The cost of a security
assessment of a laboratory is based largely on the required expertise
and would be somewhat dependant on the size of the entity. At APHIS
laboratories these assessments have ranged from $17,000 to $25,000 per
location.\13\ Many affected entities will have had entity security
assessments done in another context prior to the interim rule on select
agents and toxins, or will need far less extensive and therefore
expensive assessments.
---------------------------------------------------------------------------

\13\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

Electronic security may need to be a major part an entity's
physical security. Based on average actual security system
installations for APHIS facilities, a cost per square foot for
electronic security upgrades was developed.\14\ The security needs and
existing systems at these entities varied. The matrix cost per square
foot includes: CCTV; IDS; integration; perimeter protection; design;
construction; and construction

[[Page 13273]]

management, but not biometric technology. The cost per square foot
assumes single story entities and has been adjusted for laboratory type
entities. For buildings under 80,000 ft2 the average cost/ft
2 is $8.71. In addition, there is an adjustment factor for
retrofitting existing buildings. It should be noted that for very small
entities, the cost/ft 2 can be considerably higher.\15\ It
should also be noted that these costs per ft 2 are based on
security installations of state-of-the-art technology. In addition to
the entity security assessment and access control discussed above, a
given entity could need none, some, or all of the following to maintain
its physical security. Entry control equipment includes x-ray--small
unit ($28,000 per unit), x-ray--large unit ($40,000 per unit), and
metal detector(s) ($20,000 per unit). Other features would entail
yearly recurring costs. Off-site monitoring ($10,000 to $45,000 per
year); an equipment maintenance agreement ($12,000 to $30,000 per
year); and guard service--unarmed ($30.00/hr per security post), armed
($35.00/hr per security post), and a supervisor ($40.00/hr).\16\
Following September 11, 2001, more comprehensive security packages have
been (or will be) added to APHIS facilities including many of these
additional features. There are, however, alternatives to the specific
services that can greatly reduce costs and could be acceptable
depending on the security needs of a given entity, e.g., remote
monitoring and response to alarms instead of on-site guard service.
Also, an entity may have some or all of the services already included
in an overall facility operational and maintenance plan. An example
would be a laboratory holding select agents or toxins that is part of
an academic institution where support services are already incurred by
the academic institution, e.g., campus police for security response.
---------------------------------------------------------------------------

\14\ Robert Rice, Security Manager, APHIS select agent program.
\15\ Equivalent security needs at two buildings can have
significant differences in cost per ft 2. For example,
the need for one $1000 video camera would add $1 to the ft
2 cost of a 1000 ft 2 facility, but only $0.1
to a 10,000 ft 2 one.
\16\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

Because security needs are site-specific and the rule allows for
site-specific security solutions, the approaches and applications will
be varied. The above physical security components, and others, may have
to be added in various quantities (including none) to meet the specific
security needs of an entity. The entities covered in this rule can and
do vary from a small laboratory contained within a larger facility to
large dedicated buildings to large groups of buildings and land. Small
laboratories in larger buildings are unlikely to need access controlled
gates, a security fence, or even guard service (although a university
or commercial entity may already have a security force which would be
considered in assessing security needs). Larger entities will
inevitably have more and different security needs than small ones.
These entities naturally have more points of access and are more likely
to need features such as fences or gates to control access. In
addition, the costs themselves are very site specific; there can be
literally hundreds of variables that will influence cost at a specific
site. The variation begins with the needs of the individual entity
(views of which can differ from administration, scientist, and physical
security points of view) and is influenced by the characteristics of
the site--for example, linked areas are in different buildings, on
opposite sides of a fire wall, etc. Generally labor for installation
(approximately $96/hour in Washington, DC for installation work on
electronic access control) \17\ is the most expensive and variable cost
of these systems.
---------------------------------------------------------------------------

\17\ Christian Lee, Physical Security Specialist, USDA-APHIS-
FMD-ESB. Personal communication.
---------------------------------------------------------------------------

A review of 20 security plans of registered entities gives an
indication of the nature of security present at affected entities. It
also gives an indication of the nature of improvements to security that
have occurred since the implementation of the interim rule, or are
planned, or will need to occur at affected entities. All showed a good
base of security. In fact, a number require no improvement under this
rule. Improvements that have already occurred or have been recommended
include installing intrusion detection systems, installing or expanding
CCTV surveillance, card-key access control and standard locks. Often an
entity's standard operating procedures for security sufficiently serve
in place of a limited number or lack of electronic controls. Because
many of the affected entities deal with select agents or toxins in an
area that is fully contained in a larger structure, the lack of entry
control equipment may not affect the level of graded protection. It
should also be noted that only that portion of a given entity affected
by select agent or toxin operations is required to be secured under
this rule. On average, academic entities had 5,560 square feet,
commercial entities 2,894 square feet, and government entities 4,848
square feet to be secured.\18\
---------------------------------------------------------------------------

\18\ Based on a review of 20 security plans for select agents or
toxins submitted to APHIS. The review covered a broad spectrum of
security plans, and type of entity. Plans were reviewed at random.
Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

This rule will require that all information resources related to
select agents and toxins have an appropriate level of protection in the
system that is used to acquire, store, manipulate, manage, move,
control, display, switch, interchange, receive or transmit that
information. Most affected entities have a variety of compelling
reasons, including regulatory requirements,\19\ for already protecting
information.
---------------------------------------------------------------------------

\19\ Among others: Presidential Decision Directive 63, Critical
Infrastructure Protection; the Computer Security Act of 1987 (Public
Law (PL) 100-235); the Computer Fraud and Abuse Act (18 U.S.C. Sec.
1030 [1993]); Office of Management and Budget (OMB) Circular No. A-
123, Management Accountability and Control; Appendix III of OMB
Circular No. A-130, Management of Federal Information Resources;
FED-STD-1037A, ``An Electronic Means for Communicating Information;
and the Electronic Communications Privacy Act (18 U.S.C. 2701).
---------------------------------------------------------------------------

Other Costs

All individuals with access to select agents or toxins are required
to have the appropriate education, training and/or experience to handle
or use such agents or toxins. In addition, additional training may be
needed to familiarize staff with changes resulting from the rule. This
requirement may necessitate that affected entities provide additional
training. It is not known the extent to which training may be needed at
affected entities, and therefore the cost of providing that training is
not known. However, the National Center for Import and Export (NCIE)
within APHIS Veterinary Services has a laboratory biosafety class to
train inspectors. In FY 2002, APHIS spent $35,480 on participant and
speaker travel, speaker honoraria, and equipment and supplies to train
18 inspectors, or about $2,000 each. If we assume that each of affected
entities will have similar expenditures, and must train 25 individuals
\20\ the training cost would be $50,000 per entity or $3.8 million for
all 76 entities. It should be noted that most of the APHIS training
cost is in travel. To the extent that training at affected entities can
occur on-site, the cost per individual could be reduced.
---------------------------------------------------------------------------

\20\ The average number of individuals needing security risk
assessments per entity.
---------------------------------------------------------------------------

The rule requires that a registered entity maintain complete
records concerning activities related to select agents or toxins. This
includes an accurate, current inventory for each select agent held in
long-term storage. It is estimated that it would take eight technical
hours to complete an inventory of a freezer containing select agents or
a toxin container. Assuming that there are on average 10 freezers,

[[Page 13274]]

and 3 toxin containers at a given registered entity, it would cost
$7,200 per entity to create this baseline inventory. Based on 76
registered entities, the baseline inventory would cost a total of
$548,000. The inventory will have to be verified periodically. Assuming
that the registered entities would have to re-inventory one-half of
their freezers each year to maintain an accurate and current inventory,
yields a yearly inventory cost of $274,000.
Other record keeping includes copies of the biosafety/
biocontainment, security and incident response plans, a list of
individuals with access to select agents and toxins, training records,
inventory records, permits and transfer documents, security records,
and incident reports. It is estimated that complying with the record
keeping requirements will require 10 hours per PI (3 managerial and 7
technical hours per PI), between 10 and 90 hours per entity per year or
$745 to $6,700 per entity. The total cost of yearly record keeping is
estimated to be $132,000 based on the current number of affected
entities, and the number of PIs at those entities.
The rule also requires oral notification immediately upon discovery
of the theft or loss of select agents or toxins, followed by a written
report within 7 days. This is also the requirement for the discovery
that a release of a select agent or toxin has occurred outside of the
containment area of the entity. APHIS expects there to be two
notifications of theft, loss or release in a given year. It is
estimated that complying with these theft, loss and release
notification requirements will require one hour (0.17 managerial hours
and 0.83 technical hours), or $72 for each occurrence, for a total cost
of $144 per year. It is assumed that an incident of theft or loss will
also require a thorough inventory of the affected storage freezer or
toxin container, at a cost of $560 per occurrence, for a yearly total
of $1,120.
An individual or entity may appeal a denial, revocation, or
suspension of registration under this part. An individual may appeal a
denial, limitation, or revocation of access approval under this part.
APHIS expects there to be one appeal in a given year. It is estimated
that complying with the appeal requirements will require 2 managerial
hours and 2 technical hours, or $311 for each occurrence.
Another potential cost of the rule is on the pace and quantity of
research on select agents and toxins. If an entity chooses not to
continue work with select agents or toxins to avoid the expenditures
that will be required as a result of this rule, the impact on the
progress of scientific knowledge is unknown and likely unknowable.
However, the consequences of not securing select agents and toxins
could be extreme.

Costs to APHIS

The rule will also involve costs to APHIS. The rule will require
the government to process entity registrations, notifications of
identification of agents and toxins, exemption applications, transfer
applications, theft/loss notifications and appeals, perform inspection
and compliance activities, provide technical assistance for compliance
to affected entities, develop and maintain a database covering select
agents and toxins, develop and maintain a secure space for the
database, and obtain security clearances. The FY2004 budget for the
APHIS select agent and toxin program is $4.3 million. User fees to
offset government costs will not be collected by APHIS under this rule.

Potential Impact of This Rule

Approximately 70 percent of research & development (commercial and
non-profit laboratories dealing with human, animal and/or plant
agents), biological (except diagnostic) manufacturing, diagnostic
manufacturing, pharmaceutical manufacturing, and other private
establishments affected by this rule have fewer than 20 employees, and
another 15 percent have between 20 and 49 employees.\21\ Plant
laboratories (Federal, commercial, State, and academic) tend to be very
small, with fewer than 10 individuals having access to select agents or
toxins. Veterinary diagnostic laboratories (commercial, State or
university) and university research laboratories likely have fewer than
100 employees.\22\ Federal entities covered by the rule will be
affected by the registration requirements but should not have to make
alterations due to the biosafety, containment and security requirements
of the rule.
---------------------------------------------------------------------------

\21\ 1997 Economic Census. Department of Commerce, Census
Bureau.
\22\ AAVLD provided information on 10 veterinary diagnostic
laboratories. These laboratories ranged in size form 11 to 100
employees including faculty, staff (part- and full-time), and
students. In addition, the AAVLD president estimated that diagnostic
laboratories in general would likely have between 6 and 80
employees. According to Dr. Denise Spenser, USDA-APHIS, university
research on select agents likely involves fewer than 100 individuals
(3 to 5 principal investigators out of about 25 faculty members in
each of 3 or 4 departments--microbiology (veterinary microbiology),
chemistry, and physiology, 3 to 5 (20 at most) investigators,
technicians, and students in each laboratory).
---------------------------------------------------------------------------

The portion of an affected entity where select agents or toxins are
handled and that needs to be secure tends to be small. A review of 20
security plans of registered entities show an average of 4,449
ft2 to be secured. Seventy percent of the entities have less
than 5,000 ft2 to be secured, 20 percent between 5,000 and
10,000 ft2 to be secured, and 10 percent more than 10,000
ft2 to be secured.\23\
---------------------------------------------------------------------------

\23\ Based on a review of 20 security plans of affected
entities.
---------------------------------------------------------------------------

For the purpose of assessing the impact of the security
requirements of the rule, we make the following assumptions based on
the available information:
70 percent of affected entities have an area to be secured
of approximately 5,000 ft2,
20 percent of affected entities have an area to be secured
of approximately 7,500 ft2,
10 percent of affected entities have an area to be secured
of approximately 15,000 ft2, and
Because entities will have varying levels of existing
security, security needs, and methods of meeting those needs, the
average security upgrades in APHIS facilities is used as a proxy for
upgrades at these entities. (The proxy is based on upgrading to state-
of-the-art equipment, which may or may not be used at a given entity).
Using an average budget estimate for upgrading the electronic
portion of a security system and the average area to secure by type of
entity, we get estimates of the budget necessary to make these
upgrades. Based on a budget estimate of $10.25/square foot,\24\ an
entity with 5,000 ft2 to secure by installing electronic
security countermeasures would need to budget $51,250, an entity with
7,500 ft2 to secure would need to budget $76,875, and one
with 15,000 ft2 to secure would need to budget $153,750.
---------------------------------------------------------------------------

\24\ The baseline estimated cost/ft2 of $8.71/
ft2 for facilities less than 30,000 ft2 in size, plus an
adjustment of 17.7% for retrofitting existing structures.
---------------------------------------------------------------------------

To obtain an aggregate cost estimate we apply these budget
estimates based the size distribution of those entities. Applying a
budget cost of $51,250 to the 70 percent of affected entities that have
5,000 ft2 to secure gives a cost of $2.7 million. Applying a
budget cost of $76,875 to the 20 percent of affected entities that have
7,500 ft2 to secure gives a cost of $1.2 million. Applying a
budget cost of $153,750 to the 10 percent of affected entities that
have 15,000 ft2 to secure gives a cost of $1.2 million.

[[Page 13275]]

It should be noted that as indicated above, utilizing APHIS'' costs
as a proxy implies that all entities have baseline levels of electronic
security similar to that of APHIS facilities and will upgrade to state-
of-the-art technology. However, a review of security plans at affected
entities shows that an upgrade state-of-the-art systems is not
necessary or likely in most cases. Therefore, this proxy likely
overstates the true cost of electronic security at these entities.
In addition to electronic security, an entity could need none,
some, or all of the following:
Entity security assessment, including developing a
security plan as per the rule. Assuming that the 70 percent of entities
with less than 5,000 ft2 to secure spend $17,000, the 20
percent with between 5,000 and 10,000 ft2 to secure spend
$21,000, and the 10 percent with more than 10,000 ft2 to
secure spend $25,000 on these assessments gives a total cost of $1.4
million.
Entry control equipment; includes x-ray--small unit
($28,000 per unit), x-ray--large unit ($40,000 per unit), and metal
detector(s) ($20,000 per unit). Based on available information, we
assume that 8 affected entities would need to add entry control
equipment as a result of this rule. We further assume that each of
those entities would spend an average of $30,000 on that equipment for
a total cost of $240,000.
Off-site monitoring can range from $10,000 to $45,000 per
year. Assuming that the 70 percent of entities with less than 5,000
ft2 to secure spend $10,000, the 20 percent with between
5,000 and 10,000 ft2 to secure spend $27,500, and the 10
percent with more than 10,000 ft2 to secure spend $45,000 on
this off-site monitoring gives a total cost of $1.3 million.
Equipment maintenance agreements can range in cost from
$12,000 to $30,000 per year. Assuming that the 70 percent of entities
with less than 5,000 ft2 to secure spend $12,000, the 20
percent with between 5,000 and 10,000 ft2 to secure spend
$21,000, and the 10 percent with more than 10,000 ft2 to
secure spend $30,000 on these maintenance agreements gives a total cost
of $1.2 million.
Guard Service. Unarmed ($30.00/hr per security post),
armed ($35.00/hr per security post), and a supervisor ($40.00/hr). When
the site-specific security needs call for guards, it is the presence of
a guard that is the most important factor. Therefore, unarmed guards
would most likely be used. At most, a given entity would need a single
unarmed guard on duty 24 hours a day. The majority of affected entities
will rely on off-site monitoring, campus or local police, or existing
guard presence. Therefore, we assume that the 70 percent of entities
with less than 5,000 ft2 to secure would add no additional
guard service, the 20 percent with between 5,000 and 10,000
ft2 to secure would add an additional guard 12 hours per day
at a cost of $135,050 per year, and the 10 percent with more than
10,000 ft2 to secure would add an additional guard 24 hours
per day at a cost of $270,100 per year, giving a total annual cost of
$814,000.\25\
---------------------------------------------------------------------------

\25\ Robert Rice, Security Manager, APHIS select agent program.
---------------------------------------------------------------------------

This rule will involve other costs to the regulated community. It
is estimated that complying with the exemption and notification
requirements will have a total cost of $75,000 per year, $84 for each
exemption application and $72 for each notification of identification.
The rule will also involve the costs associated with the registration
requirements. It is estimated that it will cost each entity $380 to
collect and provide the required information, for a total cost of
$29,000. Registration amendments are expected to cost $10,000 per year,
$172 per occurrence. In addition, it is estimated that it will cost
each entity $277 for a total of $21,000 to collect and provide the
required information for re-application. Complying with the
requirements concerning the transfer of select agents and toxins could
cost $248 per occurrence or $16,000 per year. The rule could also
entail costs for any needed upgrades to biosafety and containment, and
information systems control. These costs are expected to be small. To
the extent that affected entities are already permittees, the biosafety
and containment requirements of the new act will have already been
required at those entities. Affected entities have a variety of
compelling reasons, including legislation, for already protecting
information. The rule also requires that biosafety/biocontainment,
security, and incident response plans be developed. It is estimated
that the development of the biosafety/biocontainment plan could cost
$4,500 per plan or a total of $171,000 if one-half of the affected
entities need to develop new plans. The security plan would be
developed as part of the entity security assessment discussed above. It
is estimated that developing an incident response plan will cost $2,500
per plan for a total of $99,000 if one-half of the affected entities
need to develop new plans. The cost to registrants associated with the
individual security risk assessments is in obtaining fingerprints of
individuals in the entity needing security screening. The average
entity could expect to spend $825 obtaining fingerprints initially with
a total for all entities of $63,250, and $470 annually for a total of
$35,750. It is estimated that developing a baseline inventory of select
agents and toxins at affected entities would cost $7,200 per entity for
a total of $548,000, and the yearly inventory cost will be $3,600 per
entity for a total of $274,000. Other recordkeeping is estimated at
$1,742 per entity for a total of $132,000 per year. The estimated cost
associated with training is $50,000 per entity for a total of $3.8
million. The estimated total cost associated with notifications of
theft, loss and release of select agents or toxins is $72 per
occurrence for a total of $144 per year. In addition, it is assumed
that an incident of theft or loss will also require a thorough
inventory of the affected storage freezer or toxin container, $560 per
occurrence at a yearly total cost of $1,120. The estimated total cost
associated with appeals under this rule is estimated to be $311 per
year. The estimated cost associated with expedited reviews under this
rule is estimated to be $43 per occurrence for a total of $1,000
initially and $560 per year thereafter.
The costs to APHIS include processing entity registrations,
notifications of identification of agents and toxins, exemption
applications, transfer applications, theft/loss notifications, appeals,
performing entity inspections and providing technical assistance for
compliance to affected entities, developing and maintaining a database
covering select agents and toxins, developing and maintaining a secure
space to house the database, and obtaining security clearances. The FY
2004 budget for the APHIS select agent and toxin program is $4.3
million.
Costs of the various components associated with the rule are
summarized in the following table.

[[Page 13276]]

Table 1.--Summary of Potential Costs \1\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Costs One-time costs Recurring costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Exemptions from the Rule:
Application.......................... $2,900. .....................................................
Re-application....................... ...................................................... $2,900.
Notifications of identification...... ...................................................... $72,000/yr.
Registration:
Application.......................... $29,000.
Re-application....................... ...................................................... $21,000 every 3 yrs.
Amendments........................... ...................................................... $10,000/yr.
Biosafety/Biocontainment Plan........ $171,000. .....................................................
Incident Response plan............... $99,000. .....................................................
Fingerprinting associated with SRAs.. $63,250............................................... $35,750/yr.
Security plan/entity security $17,000 to $25,000 per entity. .....................................................
assessment. $1.4 million..........................................
Transfer................................. ...................................................... $16,000/yr.
Physical security procedures: \2\
Electronic Security (cameras, card- $51,250 for 5,000 ft \2\.
readers, etc.). $76,875 for 7,500 ft \2\..............................
$153,750 for 15,000 ft \2\............................
$5.1 million..........................................
Entry control (x-ray, metal detector) $30,000 each. .....................................................
$240,000..............................................
Off-site monitoring.................. ...................................................... $10,000 to $45,000 per entity.
$1.3 million/yr.
Maintenance agreement................ ...................................................... $12,000 to $30,000 per entity.
$1.2 million/yr.
Guard service........................ ...................................................... $0 to $270,100 per entity.
$814,000/yr.
Other costs:
Training............................. $3.8 million. .....................................................
Baseline inventory................... $548,000. .....................................................
Periodic inventory................... ...................................................... $274,000/yr.
Recordkeeping........................ ...................................................... $132,000/yr.
Theft/loss/release .....................................................
Notification......................... ...................................................... $144/yr.
Additional inventory................. ...................................................... 1,120/yr.
Appeals.............................. ...................................................... $311/yr.
Expedited reviews.................... $1,000................................................ $560/yr.
---------------------------------------------------------
Total............................ $11.5 million......................................... $3.9 million.
Costs to APHIS:
Budget for select agent program...... ...................................................... $4.3 million.
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Unless otherwise noted, these are total costs for all affected entities.
\2\ Because security needs are site-specific and the rule allows for site-specific security solutions, the approaches and applications will be varied.
Actual additional physical security measures added will vary (including none) based on the current level of security and the specific security needs
of a given entity. The electronic security costs assumes 70 percent of facilities are 5,000 ft \2\, 20 percent of facilities are 7,500 ft \2\, and 10
percent of facilities are 15,000 ft \2\. The entry control equipment cost assumes 8 entities need such equipment. The off-site monitoring and
maintenance agreement costs assume all affected entities need some monitoring. The guard service cost assumes entities would need, on average, from 0
to 24 additional hours daily of unarmed guard service.

For all affected entities, estimates of the various one-time costs
associated with this rule total $11.5 million and the estimates of the
annual recurring costs total $3.9 million. The above is given to
provide perspective on the magnitude of the potential costs associated
with this rule. The costs shown here are likely overstated, however,
due to conservative assumptions used in the absence of better
information. The entities covered in this rule can and do vary from a
small laboratory contained within a larger facility to large dedicated
buildings to large groups of buildings and land. Because security needs
are site-specific and the rule allows for site-specific security
solutions, the approaches and applications will be varied. Physical
security measures may have to be added in various quantities (including
none) to meet the specific security needs of an entity. In fact, the
security plans submitted under the December 2002 interim rule shows
that the need for additional security measures is limited in many
cases. Also, some of the impacts of the rule are somewhat offset by
previous requirements, such as permit requirements in place prior to
the implementation of the December 2002 interim rule. The flexibility
in the rule also allows for site-specific needs to be met in the most
cost effective manner possible.

Regulatory Flexibility Analysis

The Regulatory Flexibility Act requires that the Agency
specifically consider the economic impact of rules on small entities.
Those entities most likely to be impacted by the rule are those
laboratories and other institutions conducting research and related
activities that involve the use of select agents and toxins. Most
affected entities (other than Federal or State governmental entities)
would be considered part of NAICS code 541710, ``Research and
Development in the Physical, Engineering, and Life Sciences.'' Some
affected entities would be considered part of NAICS 541940,
``Veterinary Services,'' NAICS 611310, ``Colleges, Universities and
Professional Schools,'' NAICS 325412 ``Pharmaceutical Preparation
Manufacturing,'' NAICS 325413 ``In-Vitro Diagnostic Substance

[[Page 13277]]

Manufacturing,'' and NAICS 325414, ``Biological Product (except
Diagnostic) Manufacturing.''
The Small Business Administration (SBA) has established guidelines
for determining when establishments are to be considered small under
the Regulatory Flexibility Act. An entity in NAICS 541710, 325413 or
325414 is considered small with 500 or fewer employees, in 325412 with
750 or fewer employees. An entity in NAICS 611310 is considered small
with annual receipts/revenues of $6 million or less.
While the establishment size breakdown in the Economic Census does
not precisely fit the SBA guidelines, it still shows that the vast
majority (more than 90 percent) of life sciences research & development
establishments can be considered small. More than 99 percent of
biological (except diagnostic) manufacturing, more than 98 percent of
diagnostic manufacturing, and at least 94 percent of pharmaceutical
manufacturing are considered small. The economic census does not
contain information on the establishment size of veterinary service
entities. According to data from the U.S. Department of Education,
about 31 percent of reporting postsecondary institutions had revenue of
less than $6 million in fiscal year 1995-96.\26\
---------------------------------------------------------------------------

\26\ IPEDS.
---------------------------------------------------------------------------

Based on the available information, this rule is not anticipated to
have a substantial impact on a significant number of small entities.

Alternatives Considered

This rule has been prompted by the need to prevent the misuse of
select agents and toxins and thereby reduce the potential for those
pathogens to harm humans, animals, animal products, plants or plant
products in the United States. In assessing the need for this rule, we
considered several alternatives to the chosen course of action.
One alternative would be to maintain the status quo, where we rely
on our authority to issue permits for the importation and interstate
movement of agents and toxins as a basis for any actions we take to
regulate select agents and toxins. We rejected this option. The Public
Health Security and Bioterrorism Preparedness and Response Act of 2002
(Pub. L. 107-188), requires that the Secretary of Agriculture establish
and enforce standards and procedures governing the possession and use
of the listed biological agents and toxins, including the establishment
and enforcement of safety requirements for the transfer of listed
agents and toxins; the establishment and enforcement of safeguard and
security measures to prevent access to listed agents and toxins for use
in domestic or international terrorism or other criminal purpose; and
the establishment of procedures to protect animal and plant health, and
animal and plant products, in the event of a transfer in violation of
the established safety and security measures.
Another alternative would involve variations to the chosen
regulatory scheme. For example, we could have chosen prescriptive
requirements for meeting the need for security around select agents and
toxins. We rejected this option. Because different agents and toxins
pose differing degrees risk, depending on factors such as their escape
potential and availability of a suitable habitat (for plant-related
agents) and transmission and effect of exposure to the agent or toxin
(for overlap and animal agents or toxins), we believe that it would be
counterproductive to attempt to prepare a detailed list of prescriptive
requirements for entities (i.e., a ``one size fits all'' design
standard). Rather, we prepared a brief set of performance standards
that we will consider to the degree to which they are appropriate to
the risks presented by a particular agent or toxin, given its intended
use and the location of the entity. In addition, these performance
based standards allow for site-specific needs to be met in the most
cost effective manner possible.

Conclusion

This rule is intended to prevent the misuse of select agents and
toxins, and thereby reduce the potential for those pathogens to harm
humans, animals, animal products, plants or plant products in the
United States. Should any select agent or toxin be intentionally
introduced into the United States, the consequences would be
significant. Consequences could include disruption of markets,
difficulties in sustaining an adequate food and fiber supply, and the
potential spread of disease infestations over large areas. In any
animal or plant disease outbreak, the government would incur the costs
of eradication. Industry would be affected through the imposition of
domestic and foreign quarantines, which would result in a loss of
markets and destruction of animals/plants if commercial properties are
found to be infected with the disease. Even though compensation can be
paid for the destroyed property, repopulating (flocks, herds, fields,
etc.) may be time consuming with additional losses from idle capital
and lost markets. In addition, there is the potential for a disruption
in the domestic food supply, whether through contamination, consumer
perception, or both. Such a disruption can have a lasting influence on
food demand and global trade.
While the costs associated with this rule could be considerable,
some of those impacts are somewhat offset. For example, requirements
such as USDA permit requirements for biosafety and containment and the
mandate to update security at USDA facilities were in place prior to
the implementation of the December 2002 interim rule. The flexibility
in the rule also allows for site-specific needs to be met in the most
cost effective manner possible. In addition, these costs are greatly
outweighed by the benefits of preventing an unintentional or deliberate
introduction of a select agent or toxin into the United States. The
cost associated with outbreaks can be very high as is demonstrated by
natural outbreaks that have occurred. Deliberate introduction greatly
increases the probability of a select agent or toxin becoming
established and causing wide-ranging and devastating impacts on the
economy, disruption to society, diminished confidence in public and
private institutions, and possible loss of life.

Paperwork Reduction Act

The December 2002 interim rule established regulations governing
the possession, use, and transfer of biological agents and toxins that
have been determined to have the potential to pose a severe threat to
public health and safety, to animal health, to plant health, or to
animal or plant products. This final rule includes certain regulatory
provisions that differ from those included in the December 2002 interim
rule. Some of those provisions involve changes from the information
collection requirements set out in the December 2002 interim rule,
which were approved by the Office of Management and Budget (OMB) under
OMB control number 0579-0213 (expires May 31, 2005).
In a separate notice in today's issue of the Federal Register,
APHIS is announcing that the information collection and recordkeeping
requirements included in this final rule have been submitted for
emergency approval to OMB.

Government Paperwork Elimination Act Compliance

The Animal and Plant Health Inspection Service is committed to
compliance with the Government Paperwork Elimination Act (GPEA),

[[Page 13278]]

which requires Government agencies in general to provide the public the
option of submitting information or transacting business electronically
to the maximum extent possible. For information pertinent to GPEA
compliance related to this rule, please contact Mrs. Celeste Sickles,
APHIS' Information Collection Coordinator, at (301) 734-7477.

List of Subjects

7 CFR Part 331

Agricultural research, Laboratories, Plant diseases and pests,
Reporting and recordkeeping requirements.

9 CFR Part 121

Agricultural research, Animal diseases, Laboratories, Medical
research, Reporting and recordkeeping requirements.

0
Accordingly, 7 CFR part 331 and 9 CFR part 121 are revised to read as
follows:

Title 7--Agriculture

0
1. Revise part 331 to read as follows:

PART 331--POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

Sec.
331.1 Definitions.
331.2 Purpose and scope.
331.3 PPQ select agents and toxins.
331.4 [Reserved]
331.5 Exemptions.
331.6 [Reserved]
331.7 Registration and related security risk assessments.
331.8 Denial, revocation, or suspension of registration.
331.9 Responsible official.
331.10 Restricting access to select agents and toxins; security risk
assessments.
331.11 Security.
331.12 Biocontainment.
331.13 Restricted experiments.
331.14 Incident response.
331.15 Training.
331.16 Transfers.
331.17 Records.
331.18 Inspections.
331.19 Notification of theft, loss, or release.
331.20 Administrative review.

Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.3.

Sec. 331.1 Definitions.

Administrator. The Administrator, Animal and Plant Health
Inspection Service, or any person authorized to act for the
Administrator.
Animal and Plant Health Inspection Service (APHIS). The Animal and
Plant Health Inspection Service of the U.S. Department of Agriculture.
Attorney General. The Attorney General of the United States or any
person authorized to act for the Attorney General.
Biological agent. Any microorganism (including, but not limited to,
bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious
substance, or any naturally occurring, bioengineered, or synthesized
component of any such microorganism or infectious substance, capable of
causing:
(1) Death, disease, or other biological malfunction in a human, an
animal, a plant, or another living organism;
(2) Deterioration of food, water, equipment, supplies, or material
of any kind; or
(3) Deleterious alteration of the environment.
Centers for Disease Control and Prevention (CDC). The Centers for
Disease Control and Prevention of the U.S. Department of Health and
Human Services.
Diagnosis. The analysis of specimens for the purpose of identifying
or confirming the presence or characteristics of a select agent or
toxin, provided that such analysis is directly related to protecting
the public health or safety, animal health or animal products, or plant
health or plant products.
Entity. Any government agency (Federal, State, or local), academic
institution, corporation, company, partnership, society, association,
firm, sole proprietorship, or other legal entity.
HHS Secretary. The Secretary of the Department of Health and Human
Services or his or her designee, unless otherwise specified.
HHS select agent and/or toxin. A biological agent or toxin listed
in 42 CFR 73.3.
Import. To move into, or the act of movement into, the territorial
limits of the United States.
Interstate. From one State into or through any other State, or
within the District of Columbia, Guam, the Virgin Islands of the United
States, or any other territory or possession of the United States.
Permit. A written authorization by the Administrator to import or
move interstate select agents or toxins, under conditions prescribed by
the Administrator.
PPQ. The Plant Protection and Quarantine Programs of the Animal and
Plant Health Inspection Service.
Responsible official. The individual designated by an entity with
the authority and control to ensure compliance with the regulations in
this part.
Select agent and/or toxin. A biological agent or toxin listed in
Sec. 331.3.
Specimen. Samples of material from humans, animals, plants, or the
environment, or isolates or cultures from such samples, for diagnosis,
verification, or proficiency testing.
State. Any of the several States of the United States, the
Commonwealth of the Northern Mariana Islands, the Commonwealth of
Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the
United States, or any other territory or possession of the United
States.
Toxin. The toxic material or product of plants, animals,
microorganisms (including, but not limited to, bacteria, viruses,
fungi, rickettsiae, or protozoa), or infectious substances, or a
recombinant or synthesized molecule, whatever their origin and method
of production, and includes:
(1) Any poisonous substance or biological product that may be
engineered as a result of biotechnology produced by a living organism;
or
(2) Any poisonous isomer or biological product, homolog, or
derivative of such a substance.
United States. All of the States.
USDA. The U.S. Department of Agriculture.
Verification. The demonstration of obtaining established
performance (e.g., accuracy, precision, and the analytical sensitivity
and specificity) specifications for any procedure used for diagnosis.

Sec. 331.2 Purpose and scope.

This part implements the provisions of the Agricultural
Bioterrorism Protection Act of 2002 setting forth the requirements for
possession, use, and transfer of select agents and toxins. The
biological agents and toxins listed in this part have the potential to
pose a severe threat to plant health or plant products.

Sec. 331.3 PPQ select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section,
the Administrator has determined that the biological agents and toxins
listed in this section have been determined to have the potential to
pose a severe threat to plant health or to plant products.
(b) PPQ select agents and toxins:
Candidatus Liberobacter africanus;
Candidatus Liberobacter asiaticus;
Peronosclerospora philippinensis;
Ralstonia solanacearum, race 3, biovar 2;
Sclerophthora rayssiae var. zeae;
Synchytrium endobioticum;
Xanthomonas oryzae pv. oryzicola;
Xylella fastidiosa (citrus variegated chlorosis strain).
(c) Genetic elements, recombinant nucleic acids, and recombinant
organisms:

[[Page 13279]]

(1) Nucleic acids that can produce infectious forms of any of the
select agent viruses listed in paragraph (b) of this section.
(2) Recombinant nucleic acids that encode for the functional forms
of any toxin listed in paragraph (b) of this section if the nucleic
acids:
(i) Can be expressed in vivo or in vitro; or
(ii) Are in a vector or recombinant host genome and can be
expressed in vivo or in vitro.
(3) Select agents and toxins listed in paragraph (b) of this
section that have been genetically modified.
(d) Select agents or toxins that meet any of the following criteria
are excluded from the requirements of this part:
(1) Any select agent or toxin that is in its naturally occurring
environment, provided that the agent or toxin has not been
intentionally introduced, cultivated, collected, or otherwise extracted
from its natural source.
(2) Nonviable select agents or nonfunctional toxins.
(e) An attenuated strain of a select agent or toxin may be excluded
from the requirements of this part based upon a determination that the
attenuated strain does not pose a severe threat to plant health or
plant products.
(1) To apply for an exclusion, an individual or entity must submit
a written request and supporting scientific information. A written
decision granting or denying the request will be issued. An exclusion
will be effective upon notification of the applicant. Exclusions will
be published periodically in the notice section of the Federal Register
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

(2) If an excluded attenuated strain is subjected to any
manipulation that restores or enhances its virulence, the resulting
select agent or toxin will be subject to the requirements of this part.
(3) An individual or entity may make a written request to the
Administrator for reconsideration of a decision denying an exclusion
application. The written request for reconsideration must state the
facts and reasoning upon which the individual or entity relies to show
the decision was incorrect. The Administrator will grant or deny the
request for reconsideration as promptly as circumstances allow and will
state, in writing, the reasons for the decision.
(f) Any select agent or toxin seized by a Federal law enforcement
agency will be excluded from the requirements of this part during the
period between seizure of the agent or toxin and the transfer or
destruction of such agent or toxin provided that:
(1) As soon as practicable, the Federal law enforcement agency
transfers the seized agent or toxin to an entity eligible to receive
such agent or toxin or destroys the agent or toxin by a recognized
sterilization or inactivation process.
(2) The Federal law enforcement agency safeguards and secures the
seized agent or toxin against theft, loss, or release, and reports any
theft, loss, or release of such agent or toxin.
(3) The Federal law enforcement agency reports the seizure of the
select agent or toxin to APHIS or CDC. The seizure must be reported
within 24 hours by telephone, facsimile, or e-mail. This report must be
followed by submission of APHIS/CDC Form 4 within 7 calendar days after
seizure of the select agent or toxin. A copy of the completed form must
be maintained for 3 years.
(4) The Federal law enforcement agency reports the final
disposition of the select agent or toxin to APHIS or CDC by submission
of APHIS/CDC Form 4. A copy of the completed form must be maintained
for 3 years.

Sec. 331.4 [Reserved]

Sec. 331.5 Exemptions.

(a) Diagnostic laboratories and other entities that possess, use,
or transfer a select agent or toxin that is contained in a specimen
presented for diagnosis or verification will be exempt from the
requirements of this part for such agent or toxin contained in the
specimen, provided that:
(1) Unless directed otherwise by the Administrator, within 7
calendar days after identification, the agent or toxin is transferred
in accordance with Sec. 331.16 or destroyed on-site by a recognized
sterilization or inactivation process;
(2) The agent or toxin is secured against theft, loss, or release
during the period between identification of the agent or toxin and
transfer or destruction of such agent or toxin, and any theft, loss, or
release of such agent or toxin is reported; and
(3) The identification of the agent or toxin is immediately
reported to APHIS or CDC by telephone, facsimile, or e-mail. This
report must be followed by submission of APHIS/CDC Form 4 within 7
calendar days after identification. Less stringent reporting may be
required during agricultural emergencies or outbreaks, or in endemic
areas. A copy of APHIS/CDC Form 4 must be maintained for 3 years.
(b) In addition to the exemption provided in paragraph (a) of this
section, the Administrator may grant a specific exemption upon a
showing of good cause and upon his or her determination that such
exemption is consistent with protecting plant health or plant products.
An individual or entity may request in writing an exemption from the
requirements of this part. If granted, such exemptions are valid for a
maximum of 3 years; thereafter, an individual or entity must request a
new exemption. If a request for exemption is denied, an individual or
entity may request reconsideration in writing to the Administrator. The
request for reconsideration must state all of the facts and reasons
upon which the individual or entity relies to show that the exemption
was wrongfully denied. The Administrator will grant or deny the request
for reconsideration as promptly as circumstances allow and will state,
in writing, the reasons for the decision.

Sec. 331.6 [Reserved]

Sec. 331.7 Registration and related security risk assessments.

(a) Unless exempted under Sec. 331.5, an individual or entity
shall not possess, use, or transfer any select agent or toxin without a
certificate of registration issued by the Administrator.
(b) As a condition of registration, each entity must designate an
individual to be its responsible official. While most registrants are
likely to be entities, in the event that an individual applies for and
is granted a certificate of registration, the individual will be
considered the responsible official.
(c)(1) As a condition of registration, the following must be
approved by the Administrator or the HHS Secretary based on a security
risk assessment by the Attorney General:
(i) The individual or entity;
(ii) The responsible official; and
(iii) Unless otherwise exempted under this section, any individual
who owns or controls the entity.
(2) Federal, State, or local governmental agencies, including
public accredited academic institutions, are exempt from the security
risk assessments for the entity and the individual who owns or controls
such entity.
(3) An individual will be deemed to own or control an entity under
the following conditions: \1\
---------------------------------------------------------------------------

\1\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

(i) For a private institution of higher education, an individual
will be deemed to own or control the entity if the individual is in a
managerial or executive capacity with regard to the

[[Page 13280]]

entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
(ii) For entities other than institutions of higher education, an
individual will be deemed to own or control the entity if the
individual:
(A) Owns 50 percent or more of the entity, or is a holder or owner
of 50 percent or more of its voting stock; or
(B) Is in a managerial or executive capacity with regard to the
entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
(4) An entity will be considered to be an institution of higher
education if it is an institution of higher education as defined in
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)),
or is an organization described in 501(c)(3) of the Internal Revenue
Code of 1986, as amended (26 U.S.C. 501(c)(3)).
(5) To obtain a security risk assessment, an individual or entity
must submit the information necessary to conduct a security risk
assessment to the Attorney General.
(d) To apply for a certificate of registration for only PPQ select
agents or toxins, or for PPQ and VS select agents or toxins, an
individual or entity must submit the information requested in the
registration application package (APHIS/CDC Form 1) to APHIS. To apply
for a certificate of registration for overlap select agents or toxins,
overlap select agents or toxins and any combination of PPQ or VS select
agents or toxins, or HHS select agents or toxins and any combination of
PPQ or VS select agents or toxins, an individual or entity must submit
the information requested in the registration application package
(APHIS/CDC Form 1) to APHIS or CDC, but not both.
(e) Prior to the issuance of a certificate of registration, the
responsible official must promptly provide notification of any changes
to the application for registration by submitting the relevant page(s)
of the registration application.
(f) The issuance of a certificate of registration may be contingent
upon inspection or submission of additional information, such as the
security plan, biosafety plan, incident response plan, or any other
documents required to be prepared under this part.
(g) A certificate of registration will be valid for one physical
location (a room, a building, or a group of buildings) where the
responsible official will be able to perform the responsibilities
required in this part, for specific select agents or toxins, and for
specific activities.
(h) A certificate of registration may be amended to reflect changes
in circumstances (e.g., replacement of the responsible official or
other personnel changes, changes in ownership or control of the entity,
changes in the activities involving any select agents or toxins, or the
addition or removal of select agents or toxins).
(1) Prior to any change, the responsible official must apply for an
amendment to a certificate of registration by submitting the relevant
page(s) of the registration application.\2\
---------------------------------------------------------------------------

\2\ Depending on the change, a security risk assessment by the
Attorney General may also be required (e.g., replacement of the
responsible official, changes in ownership or control of the entity,
new researchers or graduate students, etc.).
---------------------------------------------------------------------------

(2) The responsible official will be notified in writing if an
application to amend a certificate of registration has been approved.
Approval of an amendment may be contingent upon an inspection or
submission of additional information, such as the security plan,
biosafety plan, incident response plan, or any other documents required
to be prepared under this part.
(3) No change may be made without such approval.
(i) An entity must immediately notify APHIS or CDC if it loses the
services of its responsible official. In the event that an entity loses
the services of its responsible official, an entity may continue to
possess or use select agents or toxins only if it appoints as the
responsible official another individual who has been approved by the
Administrator or the HHS Secretary following a security risk assessment
by the Attorney General and who meets the requirements of this part.
(j) A certificate of registration will be terminated upon the
written request of the entity if the entity no longer possesses or uses
any select agents or toxins and no longer wishes to be registered.
(k) A certificate of registration will be valid for a maximum of 3
years.

Sec. 331.8 Denial, revocation, or suspension of registration.

(a) An application may be denied or a certificate of registration
revoked or suspended if:
(1) The individual or entity, the responsible official, or an
individual who owns or controls the entity is within any of the
categories described in 18 U.S.C. 175b;
(2) The individual or entity, the responsible official, or an
individual who owns or controls the entity is reasonably suspected by
any Federal law enforcement or intelligence agency of:
(i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or
(ii) Knowing involvement with an organization that engages in
domestic or international terrorism (as defined in 18 U.S.C. 2331) or
with any other organization that engages in intentional crimes of
violence; or
(iii) Being an agent of a foreign power as defined in 50 U.S.C.
1801;
(3) The individual or entity does not meet the requirements of this
part; \3\ or
---------------------------------------------------------------------------

\3\ If registration is denied for this reason, we may provide
technical assistance and guidance.
---------------------------------------------------------------------------

(4) It is determined that such action is necessary to protect plant
health or plant products.
(b) Upon revocation or suspension of a certificate of registration,
the individual or entity must:
(1) Immediately stop all use of each select agent or toxin covered
by the revocation or suspension order;
(2) Immediately safeguard and secure each select agent or toxin
covered by the revocation or suspension order from theft, loss, or
release; and
(3) Comply with all disposition instructions issued by the
Administrator for each select agent or toxin covered by the revocation
or suspension.
(c) Denial of an application for registration and revocation or
suspension of registration may be appealed under Sec. 331.20. However,
any denial of an application for registration or revocation or
suspension of a certificate of registration will remain in effect until
a final agency decision has been rendered.

Sec. 331.9 Responsible official.

[[Page 13281]]

responsible official, who may act for the responsible official in his/
her absence. These individuals must have the authority and control to
ensure compliance with the regulations when acting as the responsible
official.
(c) The responsible official must report the identification and
final disposition of any select agent or toxin contained in a specimen
for diagnosis or verification.
(1) The identification of the select agent or toxin must be
immediately reported by telephone, facsimile, or e-mail. The final
disposition of the agent or toxin must be reported by submission of
APHIS/CDC Form 4 within 7 calendar days after identification. A copy of
the completed form must be maintained for 3 years.
(2) Less stringent reporting may be required during agricultural
emergencies or outbreaks, or in endemic areas.

Sec. 331.10 Restricting access to select agents and toxins; security
risk assessments.

(a) An individual or entity required to register under this part
may not provide an individual access to a select agent or toxin, and an
individual may not access a select agent or toxin, unless the
individual is approved by the Administrator or the HHS Secretary
following a security risk assessment by the Attorney General.
(b) An individual will be deemed to have access at any point in
time if the individual has possession of a select agent or toxin (e.g.,
carries, uses, or manipulates) or the ability to gain possession of a
select agent or toxin.
(c) Each individual with access to select agents or toxins must
have the appropriate education, training, and/or experience to handle
or use such agents or toxins.
(d) To apply for access approval, each individual must submit the
information necessary to conduct a security risk assessment to the
Attorney General.
(e) An individual's security risk assessment may be expedited upon
written request by the responsible official and a showing of good cause
(e.g., agricultural emergencies, national security, or a short-term
visit by a prominent researcher). A written decision granting or
denying the request will be issued.
(f) An individual's access approval may be denied, limited, or
revoked if:
(1) The individual is within any of the categories described in 18
U.S.C. 175b;
(2) The individual is reasonably suspected by any Federal law
enforcement or intelligence agency of committing a crime set forth in
18 U.S.C. 2332b(g)(5); knowing involvement with an organization that
engages in domestic or international terrorism (as defined in 18 U.S.C.
2331) or with any other organization that engages in intentional crimes
of violence; or being an agent of a foreign power as defined in 50
U.S.C. 1801; or
(3) It is determined that such action is necessary to protect plant
health or plant products.
(g) An individual may appeal the Administrator's decision to deny,
limit, or revoke access approval under Sec. 331.20.
(h) Access approval is valid for a maximum of 5 years.
(i) The responsible official must immediately notify APHIS or CDC
when an individual's access to select agents or toxins is terminated by
the entity and the reasons therefore.

Sec. 331.11 Security.

(a) An individual or entity required to register under this part
must develop and implement a written security plan. The security plan
must be sufficient to safeguard the select agent or toxin against
unauthorized access, theft, loss, or release.
(b) The security plan must be designed according to a site-specific
risk assessment and must provide graded protection in accordance with
the risk of the select agent or toxin, given its intended use. The
security plan must be submitted upon request.
(c) The security plan must:
(1) Describe procedures for physical security, inventory control,
and information systems control;
(2) Contain provisions for the control of access to select agents
and toxins;
(3) Contain provisions for routine cleaning, maintenance, and
repairs;
(4) Establish procedures for removing unauthorized or suspicious
persons;
(5) Describe procedures for addressing loss or compromise of keys,
passwords, combinations, etc. and protocols for changing access numbers
or locks following staff changes;
(6) Contain procedures for reporting unauthorized or suspicious
persons or activities, loss or theft of select agents or toxins,
release of select agents or toxins, or alteration of inventory records;
and
(7) Contain provisions for ensuring that all individuals with
access approval from the Administrator or the HHS Secretary understand
and comply with the security procedures.
(d) An individual or entity must adhere to the following security
requirements or implement measures to achieve an equivalent or greater
level of security:
(1) Allow access only to individuals with access approval from the
Administrator or the HHS Secretary;
(2) Allow individuals not approved for access by the Administrator
or the HHS Secretary to conduct routine cleaning, maintenance, repairs,
and other activities not related to select agents or toxins only when
continuously escorted by an approved individual;
(3) Provide for the control of select agents and toxins by
requiring freezers, refrigerators, cabinets, and other containers where
select agents or toxins are stored to be secured against unauthorized
access (e.g., card access system, lock boxes);
(4) Inspect all suspicious packages before they are brought into or
removed from an area where select agents or toxins are used or stored;
(5) Establish a protocol for intra-entity transfers under the
supervision of an individual with access approval from the
Administrator or the HHS Secretary, including chain-of-custody
documents and provisions for safeguarding against theft, loss, or
release; and
(6) Require that individuals with access approval from the
Administrator or the HHS Secretary refrain from sharing with any other
person their unique means of accessing a select agent or toxin (e.g.,
keycards or passwords);
(7) Require that individuals with access approval from the
Administrator or the HHS Secretary immediately report any of the
following to the responsible official:
(i) Any loss or compromise of keys, passwords, combinations, etc.;
(ii) Any suspicious persons or activities;
(iii) Any loss or theft of select agents or toxins;
(iv) Any release of a select agent or toxin; and
(v) Any sign that inventory or use records for select agents or
toxins have been altered or otherwise compromised; and
(8) Separate areas where select agents and toxins are stored or
used from the public areas of the building.
(e) In developing a security plan, an individual or entity should
consider the document entitled, ``Laboratory Security and Emergency
Response Guidance for Laboratories Working with Select Agents,'' in
Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-
19):1-6. This document is available on the Internet at http://www.cdc.gov/mmwr
.

(f) The plan must be reviewed annually and revised as necessary.
Drills or exercises must be conducted at least annually to test and
evaluate the

[[Page 13282]]

effectiveness of the plan. The plan must be reviewed and revised, as
necessary, after any drill or exercise and after any incident.

Sec. 331.12 Biocontainment.

(a) An individual or entity required to register under this part
must develop and implement a written biocontainment plan that is
commensurate with the risk of the select agent or toxin, given its
intended use.\4\ The biocontainment plan must contain sufficient
information and documentation to describe the containment procedures.
---------------------------------------------------------------------------

\4\ Technical assistance and guidance may be obtained by
contacting APHIS.
---------------------------------------------------------------------------

(b) The biocontainment procedures must be sufficient to contain the
select agent or toxin (e.g., physical structure and features of the
entity, and operational and procedural safeguards).
(c) In developing a biocontainment plan, an individual or entity
should consider the following:
(1) ``Containment Facilities and Safeguards for Exotic Plant
Pathogens and Pests'' (Robert P. Kahn and S.B. Mathur eds., 1999); and
(2) ``A Practical Guide to Containment: Greenhouse Research with
Transgenic Plants and Microbes'' (Patricia L. Traynor ed., 2001).
(d) The plan must be reviewed annually and revised as necessary.
Drills or exercises must be conducted at least annually to test and
evaluate the effectiveness of the plan. The plan must be reviewed and
revised, as necessary, after any drill or exercise and after any
incident.

Sec. 331.13 Restricted experiments.5
---------------------------------------------------------------------------

\5\ For guidance, see the NIH publication, ``NIH Guidelines for
Research Involving Recombinant DNA Molecules.'' This document is
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

---------------------------------------------------------------------------

(a) An individual or entity may not conduct the following
experiments unless approved by and conducted in accordance with the
conditions prescribed by the Administrator:
(1) Experiments utilizing recombinant DNA that involve the
deliberate transfer of a drug resistance trait to select agents that
are not known to acquire the trait naturally, if such acquisition could
compromise the use of the drug to control disease agents in humans,
veterinary medicine, or agriculture.
(2) Experiments involving the deliberate formation of recombinant
DNA containing genes for the biosynthesis of toxins lethal for
vertebrates at an LD50<100 ng/kg body weight.
(b) The Administrator may revoke approval to conduct any of the
experiments in paragraph (a) of this section, or revoke or suspend a
certificate of registration, if the individual or entity fails to
comply with the requirements of this part.
(c) To apply for approval to conduct any of the experiments in
paragraph (a) of this section, an individual or entity must submit a
written request and supporting scientific information to the
Administrator. A written decision granting or denying the request will
be issued.

Sec. 331.14 Incident response.6
---------------------------------------------------------------------------

\6\ Nothing in this section is meant to supersede or preempt
incident response requirements imposed by other statutes or
regulations.
---------------------------------------------------------------------------

(a) An individual or entity required to register under this part
must develop and implement a written incident response plan.\7\ The
incident response plan must be coordinated with any entity-wide plans,
kept in the workplace, and available to employees for review.
---------------------------------------------------------------------------

\7\ Technical assistance and guidance may be obtained by
contacting APHIS.
---------------------------------------------------------------------------

(b) The incident response plan must fully describe the entity's
response procedures for the theft, loss, or release of a select agent
or toxin; inventory discrepancies; security breaches (including
information systems); severe weather and other natural disasters;
workplace violence; bomb threats and suspicious packages; and
emergencies such as fire, gas leak, explosion, power outage, etc. The
response procedures must account for hazards associated with the select
agent or toxin and appropriate actions to contain such agent or toxin.
(c) The incident response plan must also contain the following
information:
(1) The name and contact information (e.g., home and work) for the
individual or entity (e.g., responsible official, alternate responsible
official(s), biosafety officer, etc.);
(2) The name and contact information for the building owner and/or
manager, where applicable;
(3) The name and contact information for tenant offices, where
applicable;
(4) The name and contact information for the physical security
official for the building, where applicable;
(5) Personnel roles and lines of authority and communication;
(6) Planning and coordination with local emergency responders;
(7) Procedures to be followed by employees performing rescue or
medical duties;
(8) Emergency medical treatment and first aid;
(9) A list of personal protective and emergency equipment, and
their locations;
(10) Site security and control;
(11) Procedures for emergency evacuation, including type of
evacuation, exit route assignments, safe distances, and places of
refuge; and
(12) Decontamination procedures.
(d) The plan must be reviewed annually and revised as necessary.
Drills or exercises must be conducted at least annually to test and
evaluate the effectiveness of the plan. The plan must be reviewed and
revised, as necessary, after any drill or exercise and after any
incident.

Sec. 331.15 Training.

(a) An individual or entity required to register under this part
must provide information and training on biocontainment and security to
each individual with access approval from the Administrator or the HHS
Secretary before he/she has such access. In addition, an individual or
entity must provide information and training on biocontainment and
security to each individual not approved for access by the
Administrator or the HHS Secretary before he/she works in or visits
areas where select agents or toxins are handled or stored (e.g.,
laboratories, growth chambers, animal rooms, greenhouses, storage
areas, etc.). The training must address the particular needs of the
individual, the work they will do, and the risks posed by the select
agents or toxins.
(b) Refresher training must be provided annually.
(c) A record of the training provided to each individual must be
maintained. The record must include the name of the individual, the
date of training, a description of the training provided, and the means
used to verify that the employee understood the training.

Sec. 331.16 Transfers.

(a) Except as provided in paragraph (c) of this section, a select
agent or toxin may only be transferred to an individual or entity
registered to possess, use, or transfer that agent or toxin. A select
agent or toxin may only be transferred under the conditions of this
section and must be authorized by APHIS or CDC prior to the
transfer.\8\
---------------------------------------------------------------------------

\8\ The requirements of this section do not apply to transfers
within a registered entity (i.e., the sender and the recipient are
covered by the same certificate of registration).
---------------------------------------------------------------------------

(b) In addition to any permit required under part 330 of this
chapter, a transfer may be authorized if:
(1) The sender:

[[Page 13283]]

(i) Has at the time of transfer a certificate of registration that
covers the particular select agent or toxin to be transferred and meets
all the requirements of this part;
(ii) Meets the exemption requirements for the particular select
agent or toxin to be transferred; or
(iii) Is transferring the select agent or toxin from outside of the
United States and meets all import requirements.
(2) At the time of transfer, the recipient has a certificate of
registration that includes the particular select agent or toxin to be
transferred and meets all of the requirements of this part.
(c) On a case-by-case basis, the Administrator may authorize a
transfer of a select agent or toxin not otherwise eligible for transfer
under this part under conditions prescribed by the Administrator.
(d) To obtain authorization for a transfer, APHIS/CDC Form 2 must
be submitted.
(e) The recipient must submit a completed APHIS/CDC Form 2 within 2
business days of receipt of a select agent or toxin.
(f) The recipient must immediately notify APHIS or CDC if the
select agent or toxin has not been received within 48 hours after the
expected delivery time or if the package containing the select agent or
toxin has been damaged to the extent that a release of the select agent
or toxin may have occurred.
(g) An authorization for a transfer shall be valid only for 30
calendar days after issuance, except that such an authorization becomes
immediately null and void if any facts supporting the authorization
change (e.g., change in the certificate of registration for the sender
or recipient, change in the application for transfer).
(h) The sender must comply with all applicable laws governing
packaging and shipping.

Sec. 331.17 Records.

(a) An individual or entity required to register under this part
must maintain complete records relating to the activities covered by
this part. Such records must include:
(1) An accurate, current inventory for each select agent (including
viral genetic elements, recombinant nucleic acids, and recombinant
organisms) held in long-term storage (placement in a system designed to
ensure viability for future use, such as in a freezer or lyophilized
materials), including:
(i) The name and characteristics (e.g., strain designation, GenBank
Accession number, etc.);
(ii) The quantity acquired from another individual or entity (e.g.,
containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) Where stored (e.g., building, room, and freezer);
(iv) When moved from storage and by whom and when returned to
storage and by whom;
(v) The select agent used and purpose of use;
(vi) Records created under Sec. 331.16 (Transfers);
(vii) For intra-entity transfers (sender and the recipient are
covered by the same certificate of registration), the select agent, the
quantity transferred, the date of transfer, the sender, and the
recipient; and
(viii) Records created under Sec. 331.19 (Notification of theft,
loss, or release);
(2) An accurate, current inventory for each toxin held, including:
(i) The name and characteristics;
(ii) The quantity acquired from another individual or entity (e.g.,
containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) The initial and current quantity amount (e.g., milligrams,
milliliters, grams, etc.);
(iv) The toxin used and purpose of use, quantity, date(s) of the
use and by whom;
(v) Where stored (e.g., building, room, and freezer);
(vi) When moved from storage and by whom and when returned to
storage and by whom, including quantity amount;
(vii) Records created under Sec. 331.16 (Transfers);
(viii) For intra-entity transfers (sender and the recipient are
covered by the same certificate of registration), the toxin, the
quantity transferred, the date of transfer, the sender, and the
recipient;
(ix) Records created under Sec. 331.19 (Notification of theft,
loss, or release);
(x) If destroyed, the quantity of toxin destroyed, the date of such
action, and by whom.
(3) A current list of all individuals that have been granted access
approval by the Administrator or the HHS Secretary;
(4) Information about all entries into areas containing select
agents or toxins, including the name of the individual, name of the
escort (if applicable), and the date and time of entry;
(5) Accurate, current records created under Sec. 331.9(c)
(Responsible official), Sec. 331.11 (Security), Sec. 331.12
(Biocontainment), Sec. 331.14 (Incident response), and Sec. 331.15
(Training); and
(6) A written explanation of any discrepancies.
(b) The individual or entity must implement a system to ensure that
all records and databases created under this part are accurate, have
controlled access, and can be verified for authenticity.
(c) All records created under this part must be maintained for 3
years and promptly produced upon request.

Sec. 331.18 Inspections.

(a) Without prior notification, APHIS must be allowed to inspect
any site at which activities regulated under this part are conducted
and must be allowed to inspect and copy any records relating to the
activities covered by this part.
(b) Prior to issuing a certificate of registration to an individual
or entity, APHIS may inspect and evaluate their premises and records to
ensure compliance with this part.

Sec. 331.19 Notification of theft, loss, or release.

(a) An individual or entity must immediately notify APHIS or CDC
upon discovery of the theft or loss of a select agent or toxin. Thefts
or losses must be reported even if the select agent or toxin is
subsequently recovered or the responsible parties are identified.
(1) The theft or loss of a select agent or toxin must be reported
by telephone, facsimile, or e-mail. The following information must be
provided:
(i) The name of the select agent or toxin and any identifying
information (e.g., strain or other characterization information);
(ii) An estimate of the quantity stolen or lost;
(iii) An estimate of the time during which the theft or loss
occurred;
(iv) The location (building, room) from which the theft or loss
occurred; and
(v) The list of Federal, State, or local law enforcement agencies
to which the individual or entity reported, or intends to report, the
theft or loss.
(2) A completed APHIS/CDC Form 3 must be submitted within 7
calendar days.
(b) An individual or entity must notify APHIS or CDC immediately
upon discovery of a release of a select agent or toxin outside of the
primary barriers of the biocontainment area.
(1) The release of a select agent or toxin must be reported by
telephone, facsimile, or e-mail. The following information must be
provided:
(i) The name of the select agent or toxin and any identifying
information (e.g., strain or other characterization information);
(ii) An estimate of the quantity released;
(iii) The time and duration of the release;
(iv) The environment into which the release occurred (e.g., in
building or outside of building, waste system);

[[Page 13284]]

(v) The location (building, room) from which the release occurred;
and
(vi) The number of individuals potentially exposed at the entity;
(vii) Actions taken to respond to the release; and
(viii) Hazards posed by the release.
(2) A completed APHIS/CDC Form 3 must be submitted within 7
calendar days.

Sec. 331.20 Administrative review.

An individual or entity may appeal a denial, revocation, or
suspension of registration under this part. An individual may appeal a
denial, limitation, or revocation of access approval under this
part.\9\ The appeal must be in writing, state the factual basis for the
appeal, and be submitted to the Administrator within 30 calendar days
of the decision. Where the denial, revocation, or suspension of
registration or the denial, limitation, or revocation of an
individual's access approval is based upon an identification by the
Attorney General, the request for review will be forwarded to the
Attorney General. The Administrator's decision constitutes final agency
action.
---------------------------------------------------------------------------

\9\ An entity may not appeal the denial or limitation of an
individual's access to select agents or toxins.
---------------------------------------------------------------------------

Title 9--Animals and Animal Products

0
2. Revise part 121 to read as follows:

PART 121--POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS

Sec.
121.1 Definitions.
121.2 Purpose and scope.
121.3 VS select agents and toxins.
121.4 Overlap select agents and toxins.
121.5 Exemptions for VS select agents and toxins.
121.6 Exemptions for overlap select agents and toxins.
121.7 Registration and related security risk assessments.
121.8 Denial, revocation, or suspension of registration.
121.9 Responsible official.
121.10 Restricting access to select agents and toxins; security risk
assessments.
121.11 Security.
121.12 Biosafety.
121.13 Restricted experiments.
121.14 Incident response.
121.15 Training.
121.16 Transfers.
121.17 Records.
121.18 Inspections.
121.19 Notification of theft, loss, or release.
121.20 Administrative review.

Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.4.

Sec. 121.1 Definitions.

Administrator. The Administrator, Animal and Plant Health
Inspection Service, or any person authorized to act for the
Administrator.
Animal and Plant Health Inspection Service (APHIS). The Animal and
Plant Health Inspection Service of the U.S. Department of Agriculture.
Attorney General. The Attorney General of the United States or any
person authorized to act for the Attorney General.
Biological agent. Any microorganism (including, but not limited to,
bacteria, viruses, fungi, rickettsiae, or protozoa), or infectious
substance, or any naturally occurring, bioengineered, or synthesized
component of any such microorganism or infectious substance, capable of
causing:
(1) Death, disease, or other biological malfunction in a human, an
animal, a plant, or another living organism;
(2) Deterioration of food, water, equipment, supplies, or material
of any kind; or
(3) Deleterious alteration of the environment.
Centers for Disease Control and Prevention (CDC). The Centers for
Disease Control and Prevention of the U.S. Department of Health and
Human Services.
Diagnosis. The analysis of specimens for the purpose of identifying
or confirming the presence or characteristics of a select agent or
toxin, provided that such analysis is directly related to protecting
the public health or safety, animal health or animal products, or plant
health or plant products.
Entity. Any government agency (Federal, State, or local), academic
institution, corporation, company, partnership, society, association,
firm, sole proprietorship, or other legal entity.
HHS Secretary. The Secretary of the Department of Health and Human
Services or his or her designee, unless otherwise specified.
HHS select agent and/or toxin. A biological agent or toxin listed
in 42 CFR 73.3.
Import. To move into, or the act of movement into, the territorial
limits of the United States.
Interstate. From one State into or through any other State, or
within the District of Columbia, Guam, the Virgin Islands of the United
States, or any other territory or possession of the United States.
Overlap select agent and/or toxin. A biological agent or toxin that
is listed in Sec. 121.4 and 42 CFR 73.4.
Permit. A written authorization by the Administrator to import or
move interstate select agents or toxins, under conditions prescribed by
the Administrator.
Proficiency testing. The process of determining the competency of
an individual or laboratory to perform a specified test or procedure.
Responsible official. The individual designated by an entity with
the authority and control to ensure compliance with the regulations in
this part.
Select agent and/or toxin. Unless otherwise specified, all of the
biological agents or toxins listed in Sec. Sec. 121.3 and 121.4.
Specimen. Samples of material from humans, animals, plants, or the
environment, or isolates or cultures from such samples, for diagnosis,
verification, or proficiency testing.
State. Any of the several States of the United States, the
Commonwealth of the Northern Mariana Islands, the Commonwealth of
Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the
United States, or any other territory or possession of the United
States.
Toxin. The toxic material or product of plants, animals,
microorganisms (including, but not limited to, bacteria, viruses,
fungi, rickettsiae, or protozoa), or infectious substances, or a
recombinant or synthesized molecule, whatever their origin and method
of production, and includes:
(1) Any poisonous substance or biological product that may be
engineered as a result of biotechnology produced by a living organism;
or
(2) Any poisonous isomer or biological product, homolog, or
derivative of such a substance.
United States. All of the States.
USDA. The U.S. Department of Agriculture.
Verification. The demonstration of obtaining established
performance (e.g., accuracy, precision, and the analytical sensitivity
and specificity) specifications for any procedure used for diagnosis.
VS. The Veterinary Services Programs of the Animal and Plant Health
Inspection Service.
VS select agent and/or toxin. A biological agent or toxin listed in
Sec. 121.3.

Sec. 121.2 Purpose and scope.

[[Page 13285]]

to animal health, or to animal products. Overlap select agents and
toxins are subject to regulation by both APHIS and CDC.

Sec. 121.3 VS select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section,
the Administrator has determined that the biological agents and toxins
listed in this section have the potential to pose a severe threat to
animal health or to animal products.
(b) VS select agents and toxins:
African horse sickness virus;
African swine fever virus;
Akabane virus;
Avian influenza virus (highly pathogenic);
Bluetongue virus (exotic);
Bovine spongiform encephalopathy agent;
Camel pox virus;
Classical swine fever virus;
Cowdria ruminantium (Heartwater);
Foot-and-mouth disease virus;
Goat pox virus;
Japanese encephalitis virus;
Lumpy skin disease virus;
Malignant catarrhal fever virus (Alcelaphine herpesvirus type 1);
Menangle virus;
Mycoplasma capricolum/M. F38/M. mycoides capri (contagious caprine
pleuropneumonia);
Mycoplasma mycoides mycoides (contagious bovine pleuropneumonia);
Newcastle disease virus (velogenic);
Peste des petits ruminants virus;
Rinderpest virus;
Sheep pox virus;
Swine vesicular disease virus;
Vesicular stomatitis virus (exotic).
(c) Genetic elements, recombinant nucleic acids, and recombinant
organisms:
(1) Nucleic acids that can produce infectious forms of any of the
select agent viruses listed in paragraph (b) of this section.\1\
---------------------------------------------------------------------------

\1\ The importation and interstate movement of VS select agents
or toxins listed in paragraphs (c)(1) through (c)(3) of this section
may be subject to the permit requirements under part 122 of this
subchapter.
---------------------------------------------------------------------------

(2) Recombinant nucleic acids that encode for the functional forms
of any toxin listed in paragraph (b) of this section if the nucleic
acids:
(i) Can be expressed in vivo or in vitro; or
(ii) Are in a vector or recombinant host genome and can be
expressed in vivo or in vitro.
(3) VS select agents and toxins listed in paragraph (b) of this
section that have been genetically modified.
(d) VS select agents or toxins that meet any of the following
criteria are excluded from the requirements of this part:
(1) Any VS select agent or toxin that is in its naturally occurring
environment, provided that the agent or toxin has not been
intentionally introduced, cultivated, collected, or otherwise extracted
from its natural source.
(2) Nonviable VS select agents or nonfunctional VS toxins.\2\
---------------------------------------------------------------------------

\2\ However, the importation and interstate movement of these
nonviable select agents may be subject to the permit requirements
under part 122 of this subchapter.
---------------------------------------------------------------------------

(e) An attenuated strain of a VS select agent or toxin may be
excluded from the requirements of this part based upon a determination
that the attenuated strain does not pose a severe threat to animal
health or to animal products.
(1) To apply for an exclusion, an individual or entity must submit
a written request and supporting scientific information. A written
decision granting or denying the request will be issued. An exclusion
will be effective upon notification of the applicant. Exclusions will
be published periodically in the notice section of the Federal Register
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

(2) If an excluded attenuated strain is subjected to any
manipulation that restores or enhances its virulence, the resulting
select agent or toxin will be subject to the requirements of this part.
(3) An individual or entity may make a written request to the
Administrator for reconsideration of a decision denying an exclusion
application. The written request for reconsideration must state the
facts and reasoning upon which the individual or entity relies to show
the decision was incorrect. The Administrator will grant or deny the
request for reconsideration as promptly as circumstances allow and will
state, in writing, the reasons for the decision.
(f) Any VS select agent or toxin seized by a Federal law
enforcement agency will be excluded from the requirements of this part
during the period between seizure of the agent or toxin and the
transfer or destruction of such agent or toxin provided that:
(1) As soon as practicable, the Federal law enforcement agency
transfers the seized agent or toxin to an entity eligible to receive
such agent or toxin or destroys the agent or toxin by a recognized
sterilization or inactivation process.
(2) The Federal law enforcement agency safeguards and secures the
seized agent or toxin against theft, loss, or release, and reports any
theft, loss, or release of such agent or toxin.
(3) The Federal law enforcement agency reports the seizure of the
select agent or toxin to APHIS or CDC.
(i) The seizure of any of the following VS select agents and toxins
must be reported within 24 hours by telephone, facsimile, or e-mail:
African horse sickness virus, African swine fever virus, avian
influenza virus (highly pathogenic), bovine spongiform encephalopathy
agent, classical swine fever virus, foot-and-mouth disease virus,
Newcastle disease virus (velogenic), rinderpest virus, and swine
vesicular disease virus. This report must be followed by submission of
APHIS/CDC Form 4 within 7 calendar days after seizure of the select
agent or toxin.
(ii) For all other VS select agents or toxins, APHIS/CDC Form 4
must be submitted within 7 calendar days after seizure of the agent or
toxin.
(iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
(4) The Federal law enforcement agency reports the final
disposition of the select agent or toxin by submission of APHIS/CDC
Form 4. A copy of the completed form must be maintained for 3 years.

Sec. 121.4 Overlap select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section,
the Administrator has determined that the biological agents and toxins
listed in this section have the potential to pose a severe threat to
public health and safety, to animal health, or to animal products.
(b) Overlap select agents and toxins:
Bacillus anthracis;
Botulinum neurotoxins;
Botulinum neurotoxin producing species of Clostridium;
Brucella abortus;
Brucella melitensis;
Brucella suis;
Burkholderia mallei;
Burkholderia pseudomallei;
Clostridium perfringens epsilon toxin;
Coccidioides immitis;
Coxiella burnetii;
Eastern equine encephalitis virus;
Francisella tularensis;
Hendra virus;
Nipah virus;
Rift Valley fever virus;
Shigatoxin;
Staphylococcal enterotoxins;
T-2 toxin;
Venezuelan equine encephalitis virus.
(c) Genetic elements, recombinant nucleic acids, and recombinant
organisms:
(1) Nucleic acids that can produce infectious forms of any of the
overlap

[[Page 13286]]

select agent viruses listed in paragraph (b) of this section.\3\
---------------------------------------------------------------------------

\3\ The importation and interstate movement of overlap select
agents or toxins listed in paragraphs (c)(1) through (c)(3) of this
section may be subject to the permit requirements under part 122 of
this subchapter.
---------------------------------------------------------------------------

(2) Recombinant nucleic acids that encode for the functional forms
of any overlap toxin listed in paragraph (b) of this section if the
nucleic acids:
(i) Can be expressed in vivo or in vitro; or
(ii) Are in a vector or recombinant host genome and can be
expressed in vivo or in vitro.
(3) Overlap select agents and toxins listed in paragraph (b) of
this section that have been genetically modified.
(d) Overlap select agents or toxins that meet any of the following
criteria are excluded from the requirements of this part:
(1) Any overlap select agent or toxin that is in its naturally
occurring environment, provided that the agent or toxin has not been
intentionally introduced, cultivated, collected, or otherwise extracted
from its natural source.
(2) Nonviable overlap select agents or nonfunctional overlap
toxins.\4\
---------------------------------------------------------------------------

\4\ However, the importation and interstate movement of these
nonviable overlap select agents may be subject to the permit
requirements under part 122 of this subchapter.
---------------------------------------------------------------------------

(3) Overlap toxins under the control of a principal investigator,
treating physician or veterinarian, or commercial manufacturer or
distributor, if the aggregate amount does not, at any time, exceed the
following amounts: 0.5 mg of Botulinum neurotoxins, 100 mg of
Clostridium perfringens epsilon toxin, 100 mg of Shigatoxin, 5 mg of
Staphylococcal enterotoxins, and 1,000 mg of T-2 toxin.
(e) An attenuated strain of an overlap select agent or toxin may be
excluded from the requirements of this part based upon a determination
that the attenuated strain does not pose a severe threat to public
health and safety, to animal health, or to animal products.
(1) To apply for an exclusion, an individual or entity must submit
a written request and supporting scientific information. A written
decision granting or denying the request will be issued. An exclusion
will be effective upon notification of the applicant. Exclusions will
be published periodically in the notice section of the Federal Register
and will be listed on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

(2) If an excluded attenuated strain is subjected to any
manipulation that restores or enhances its virulence, the resulting
overlap select agent or toxin will be subject to the requirements of
this part.
(3) An individual or entity may make a written request to the
Administrator for reconsideration of a decision denying an exclusion
application. The written request for reconsideration must state the
facts and reasoning upon which the individual or entity relies to show
the decision was incorrect. The Administrator will grant or deny the
request for reconsideration as promptly as circumstances allow and will
state, in writing, the reasons for the decision.
(f) Any overlap select agent or toxin seized by a Federal law
enforcement agency will be excluded from the requirements of this part
during the period between seizure of the agent or toxin and the
transfer or destruction of such agent or toxin provided that:
(1) As soon as practicable, the Federal law enforcement agency
transfers the seized agent or toxin to an entity eligible to receive
such agent or toxin or destroys the agent or toxin by a recognized
sterilization or inactivation process.
(2) The Federal law enforcement agency safeguards and secures the
seized agent or toxin against theft, loss, or release, and reports any
theft, loss, or release of such agent or toxin.
(3) The Federal law enforcement agency reports the seizure of the
overlap select agent or toxin to APHIS or CDC.
(i) The seizure of any of the following overlap select agents and
toxins must be reported within 24 hours by telephone, facsimile, or e-
mail: Bacillus anthracis, Botulinum neurotoxins, Brucella melitensis,
Francisella tularensis, Hendra virus, Nipah virus, Rift Valley fever
virus, and Venezuelan equine encephalitis virus. This report must be
followed by submission of APHIS/CDC Form 4 within 7 calendar days after
seizure of the overlap select agent or toxin.
(ii) For all other overlap select agents or toxins, APHIS/CDC Form
4 must be submitted within 7 calendar days after seizure of the agent
or toxin.
(iii) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
(4) The Federal law enforcement agency reports the final
disposition of the overlap select agent or toxin by submission of
APHIS/CDC Form 4. A copy of the completed form must be maintained for 3
years.

Sec. 121.5 Exemptions for VS select agents and toxins.

(a) Diagnostic laboratories and other entities that possess, use,
or transfer a VS select agent or toxin that is contained in a specimen
presented for diagnosis or verification will be exempt from the
requirements of this part for such agent or toxin contained in the
specimen, provided that:
(1) Unless directed otherwise by the Administrator, within 7
calendar days after identification, the agent or toxin is transferred
in accordance with Sec. 121.16 or destroyed on-site by a recognized
sterilization or inactivation process;
(2) The agent or toxin is secured against theft, loss, or release
during the period between identification of the agent or toxin and
transfer or destruction of such agent or toxin, and any theft, loss, or
release of such agent or toxin is reported; and
(3) The identification of the agent or toxin is reported to APHIS
or CDC.
(i) The identification of any of the following select agents and
toxins must be immediately reported by telephone, facsimile, or e-mail:
African horse sickness virus, African swine fever virus, avian
influenza virus (highly pathogenic), bovine spongiform encephalopathy
agent, classical swine fever virus, foot-and-mouth disease virus,
Newcastle disease virus (velogenic), rinderpest virus, and swine
vesicular disease virus. This report must be followed by submission of
APHIS/CDC Form 4 within 7 calendar days after identification.
(ii) For all other VS select agents or toxins, APHIS/CDC Form 4
must be submitted within 7 calendar days after identification.
(iii) Less stringent reporting may be required during agricultural
emergencies or outbreaks, or in endemic areas.
(iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
(b) Diagnostic laboratories and other entities that possess, use,
or transfer a VS select agent or toxin that is contained in a specimen
presented for proficiency testing will be exempt from the requirements
of this part for such agent or toxin contained in the specimen,
provided that:
(1) Unless directed otherwise by the Administrator, within 90
calendar days of receipt, the agent or toxin is transferred in
accordance with Sec. 121.16 or destroyed on-site by a recognized
sterilization or inactivation process;
(2) The agent or toxin is secured against theft, loss, or release
during the period between identification of the agent or toxin and
transfer or destruction of such agent or toxin, and any theft, loss, or
release of such agent or toxin is reported; and
(3) The identification of the agent or toxin, and its derivative,
is reported to APHIS or CDC. To report the

[[Page 13287]]

identification of a select agent or toxin, APHIS/CDC Form 4 must be
submitted within 90 days of receipt of the agent or toxin. A copy of
the completed form must be maintained for 3 years.
(c) Diagnostic reagents and vaccines that are, bear, or contain VS
select agents or toxins that are produced at USDA diagnostic facilities
will be exempt from the requirements of this part.
(d) Unless the Administrator by order determines that additional
regulation is necessary to protect animal health or animal products,
products that are, bear, or contain VS select agents or toxins will be
exempt from the requirements of this part if the products have been
cleared, approved, licensed, or registered pursuant to:
(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et
seq.);
(2) Section 351 of Public Health Service Act (42 U.S.C. 262);
(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7
U.S.C. 131 et seq.).
(e) The Administrator may exempt from the requirements of this part
an experimental product that is, bears, or contains a VS select agent
or toxin if such product is being used in an investigation authorized
by any Federal law and the Administrator determines that additional
regulation under this part is not necessary to protect animal health or
animal products. To apply for an exemption, an individual or entity
must submit APHIS/CDC Form 5. A written decision granting or denying
the exemption will be issued. The applicant must notify APHIS when an
authorization for an investigation no longer exists. This exemption
automatically terminates when such authorization is no longer in
effect.
(f) In addition to the exemptions provided in paragraphs (a)
through (e) of this section, the Administrator may grant a specific
exemption upon a showing of good cause and upon his or her
determination that such exemption is consistent with protecting animal
health or animal products. An individual or entity may request in
writing an exemption from the requirements of this part. If granted,
such exemptions are valid for a maximum of 3 years; thereafter, an
individual or entity must request a new exemption. If a request for
exemption is denied, an individual or entity may request
reconsideration in writing to the Administrator. The request for
reconsideration must state all of the facts and reasons upon which the
individual or entity relies to show that the exemption was wrongfully
denied. The Administrator will grant or deny the request for
reconsideration as promptly as circumstances allow and will state, in
writing, the reasons for the decision.

Sec. 121.6 Exemptions for overlap select agents and toxins.

(a) Clinical or diagnostic laboratories and other entities that
possess, use, or transfer an overlap select agent or toxin that is
contained in a specimen presented for diagnosis or verification will be
exempt from the requirements of this part for such agent or toxin
contained in the specimen, provided that:
(1) Unless directed otherwise by the Administrator or the HHS
Secretary, within 7 calendar days after identification, the agent or
toxin is transferred in accordance with Sec. 121.16 or 42 CFR 73.16 or
destroyed on-site by a recognized sterilization or inactivation
process;
(2) The agent or toxin is secured against theft, loss, or release
during the period between identification of the agent or toxin and
transfer or destruction of such agent or toxin, and any theft, loss, or
release of such agent or toxin is reported; and
(3) The identification of the agent or toxin is reported to APHIS
or CDC.
(i) The identification of any of the following overlap select
agents and toxins must be immediately reported by telephone, facsimile,
or e-mail: Bacillus anthracis, Botulinum neurotoxins, Brucella
melitensis, Francisella tularensis, Hendra virus, Nipah virus, Rift
Valley fever virus, and Venezuelan equine encephalitis virus. This
report must be followed by submission of APHIS/CDC Form 4 within 7
calendar days after identification.
(ii) For all other overlap select agents or toxins, APHIS/CDC Form
4 must be submitted within 7 calendar days after identification.
(iii) Less stringent reporting may be required during agricultural
emergencies or outbreaks, or in endemic areas.
(iv) A copy of APHIS/CDC Form 4 must be maintained for 3 years.
(b) Clinical or diagnostic laboratories and other entities that
possess, use, or transfer an overlap select agent or toxin that is
contained in a specimen presented for proficiency testing will be
exempt from the requirements of this part for such agent or toxin
contained in the specimen, provided that:
(1) Unless directed otherwise by the Administrator or the HHS
Secretary, within 90 days of receipt, the agent or toxin is transferred
in accordance with Sec. 121.16 or 42 CFR 73.16 or destroyed on-site by
a recognized sterilization or inactivation process;
(2) The agent or toxin is secured against theft, loss, or release
during the period between identification of the agent or toxin and
transfer or destruction of such agent or toxin, and any theft, loss, or
release of such agent or toxin is reported; and
(3) The identification of the agent or toxin, and its derivative,
is reported to APHIS or CDC. To report the identification of an overlap
select agent or toxin, APHIS/CDC Form 4 must be submitted within 90
calendar days of receipt of the agent or toxin. A copy of the completed
form must be maintained for 3 years.
(c) Unless the Administrator by order determines that additional
regulation of a specific product is necessary to protect animal health
or animal products, products that are, bear, or contain overlap select
agents or toxins will be exempt from the requirements of this part if
the products have been cleared, approved, licensed, or registered
pursuant to:
(1) The Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et
seq.);
(2) Section 351 of Public Health Service Act (42 U.S.C. 262);
(3) The Virus-Serum-Toxin Act (21 U.S.C. 151-159); or
(4) The Federal Insecticide, Fungicide, and Rodenticide Act (7
U.S.C. 131 et seq.).
(d) After consultation with the HHS Secretary, the Administrator
may exempt from the requirements of this part an investigational
product that is, bears, or contains an overlap select agent or toxin if
such product is being used in an investigation authorized by any
Federal law and the Administrator determines that additional regulation
under this part is not necessary to protect animal health or animal
products.
(1) To apply for an exemption, an individual or entity must submit
APHIS/CDC Form 5.
(2) The Administrator will make a determination regarding an
exemption within 14 calendar days after receipt of the application and
notification that the investigation has been authorized under a Federal
law. A written decision granting or denying the exemption will be
issued.
(3) The applicant must notify APHIS or CDC when an authorization
for an investigation no longer exists. This exemption automatically
terminates when such authorization is no longer in effect.
(e) The Administrator may exempt an individual or entity from the

[[Page 13288]]

requirements of this part for 30 calendar days if it is necessary to
respond to a domestic or foreign agricultural emergency involving an
overlap select agent or toxin. The Administrator may extend the
exemption once for an additional 30 days. An individual or entity may
apply for this exemption by submitting APHIS/CDC Form 5. A written
decision granting or denying the exemption will be issued.
(f) Upon request of the Secretary of Health and Human Services, the
Administrator may exempt an individual or entity from the requirements
of this part for 30 calendar days if the Secretary of Health and Human
Services has granted an exemption for a public health emergency
involving an overlap select agent or toxin. The Administrator may
extend the exemption once for an additional 30 days.

Sec. 121.7 Registration and related security risk assessments.

(a) Unless exempted under Sec. 121.5, an individual or entity
shall not possess, use, or transfer any VS select agent or toxin
without a certificate of registration issued by the Administrator.
Unless exempted under Sec. 121.6 or 42 CFR 73.6, an individual or
entity shall not possess, use, or transfer any overlap select agent or
toxin without a certificate of registration issued by the Administrator
and the HHS Secretary.
(b) As a condition of registration, each entity must designate an
individual to be its responsible official. While most registrants are
likely to be entities, in the event that an individual applies for and
is granted a certificate of registration, the individual will be
considered the responsible official.
(c)(1) As a condition of registration, the following must be
approved by the Administrator or the HHS Secretary based on a security
risk assessment by the Attorney General:
(i) The individual or entity;
(ii) The responsible official; and
(iii) Unless otherwise exempted under this section, any individual
who owns or controls the entity.
(2) Federal, State, or local governmental agencies, including
public accredited academic institutions, are exempt from the security
risk assessments for the entity and the individual who owns or controls
such entity.
(3) An individual will be deemed to own or control an entity under
the following conditions: \5\
---------------------------------------------------------------------------

\5\ These conditions may apply to more than one individual.
---------------------------------------------------------------------------

(i) For a private institution of higher education, an individual
will be deemed to own or control the entity if the individual is in a
managerial or executive capacity with regard to the entity's select
agents or toxins or with regard to the individuals with access to the
select agents or toxins possessed, used, or transferred by the entity.
(ii) For entities other than institutions of higher education, an
individual will be deemed to own or control the entity if the
individual:
(A) Owns 50 percent or more of the entity, or is a holder or owner
of 50 percent or more of its voting stock; or
(B) Is in a managerial or executive capacity with regard to the
entity's select agents or toxins or with regard to the individuals with
access to the select agents or toxins possessed, used, or transferred
by the entity.
(4) An entity will be considered to be an institution of higher
education if it is an institution of higher education as defined in
section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)),
or is an organization described in 501(c)(3) of the Internal Revenue
Code of 1986, as amended (26 U.S.C. 501(c)(3)).
(5) To obtain a security risk assessment, an individual or entity
must submit the information necessary to conduct a security risk
assessment to the Attorney General.
(d) To apply for a certificate of registration for only VS select
agents or toxins, or for VS and PPQ select agents or toxins, an
individual or entity must submit the information requested in the
registration application package (APHIS/CDC Form 1) to APHIS. To apply
for a certificate of registration for overlap select agents or toxins,
overlap select agents or toxins and any combination of PPQ or VS select
agents or toxins, or HHS select agents or toxins and any combination of
PPQ or VS select agents or toxins, an individual or entity must submit
the information requested in the registration application package
(APHIS/CDC Form 1) to APHIS or CDC, but not both.
(e) Prior to the issuance of a certificate of registration, the
responsible official must promptly provide notification of any changes
to the application for registration by submitting the relevant page(s)
of the registration application.
(f) The issuance of a certificate of registration may be contingent
upon inspection or submission of additional information, such as the
security plan, biosafety plan, incident response plan, or any other
documents required to be prepared under this part.
(g) A certificate of registration will be valid for one physical
location (a room, a building, or a group of buildings) where the
responsible official will be able to perform the responsibilities
required in this part, for specific select agents or toxins, and for
specific activities.
(h) A certificate of registration may be amended to reflect changes
in circumstances (e.g., replacement of the responsible official or
other personnel changes, changes in ownership or control of the entity,
changes in the activities involving any select agents or toxins, or the
addition or removal of select agents or toxins).
(1) Prior to any change, the responsible official must apply for an
amendment to a certificate of registration by submitting the relevant
page(s) of the registration application.\6\
---------------------------------------------------------------------------

\6\ Depending on the change, a security risk assessment by the
Attorney General may also be required (e.g., replacement of the
responsible official, changes in ownership or control of the entity,
new researchers or graduate students, etc.)
---------------------------------------------------------------------------

Sec. 121.8 Denial, revocation, or suspension of registration.

[[Page 13289]]

who owns or controls the entity is reasonably suspected by any Federal
law enforcement or intelligence agency of:
(i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or
(ii) Knowing involvement with an organization that engages in
domestic or international terrorism (as defined in 18 U.S.C. 2331) or
with any other organization that engages in intentional crimes of
violence; or
(iii) Being an agent of a foreign power as defined in 50 U.S.C.
1801;
(3) The individual or entity does not meet the requirements of this
part; \7\ or
---------------------------------------------------------------------------

\7\ If registration is denied for this reason, we may provide
technical assistance and guidance.
---------------------------------------------------------------------------

(4) It is determined that such action is necessary to protect
animal health or animal products.
(b) Upon revocation or suspension of a certificate of registration,
the individual or entity must:
(1) Immediately stop all use of each select agent or toxin covered
by the revocation or suspension order;
(2) Immediately safeguard and secure each select agent or toxin
covered by the revocation or suspension order from theft, loss, or
release; and
(3) Comply with all disposition instructions issued by the
Administrator for each select agent or toxin covered by the revocation
or suspension.
(c) Denial of an application for registration and revocation of
registration may be appealed under Sec. 121.20. However, any denial of
an application for registration or revocation of a certificate of
registration will remain in effect until a final agency decision has
been rendered.

Sec. 121.9 Responsible official.

(a) An individual or entity required to register under this part
must designate an individual to be the responsible official. The
responsible official must:
(1) Be approved by the Administrator or the HHS Secretary following
a security risk assessment by the Attorney General;
(2) Be familiar with the requirements of this part;
(3) Have authority and responsibility to act on behalf of the
entity;
(4) Ensure compliance with the requirements of this part; and
(5) Ensure that annual inspections are conducted for each
laboratory where select agents or toxins are stored or used in order to
determine compliance with the requirements of this part. The results of
each inspection must be documented, and any deficiencies identified
during an inspection must be corrected.
(b) An entity may designate one or more individuals to be an
alternate responsible official, who may act for the responsible
official in his/her absence. These individuals must have the authority
and control to ensure compliance with the regulations when acting as
the responsible official.
(c) The responsible official must report the identification and
final disposition of any select agent or toxin contained in a specimen
presented for diagnosis or verification.
(1) The identification of any of the following select agents or
toxins must be immediately reported by telephone, facsimile, or e-mail:
African horse sickness virus, African swine fever virus, avian
influenza virus (highly pathogenic), Bacillus anthracis, Botulinum
neurotoxins, bovine spongiform encephalopathy agent, Brucella
melitensis, classical swine fever virus, foot-and-mouth disease virus,
Francisella tularensis, Hendra virus, Newcastle disease virus
(velogenic), Nipah virus, Rift Valley fever virus, rinderpest virus,
swine vesicular disease virus, and Venezuelan equine encephalitis
virus. The final disposition of the agent or toxin must be reported by
submission of APHIS/CDC Form 4 within 7 calendar days after
identification. A copy of the completed form must be maintained for 3
years.
(2) To report the identification and final disposition of any other
select agent or toxin, APHIS/CDC Form 4 must be submitted within 7
calendar days after identification. A copy of the completed form must
be maintained for 3 years.
(3) Less stringent reporting may be required during agricultural
emergencies or outbreaks, or in endemic areas.
(d) The responsible official must report the identification and
final disposition of any select agent or toxin contained in a specimen
presented for proficiency testing. To report the identification and
final disposition of a select agent or toxin, APHIS/CDC Form 4 must be
submitted within 90 calendar days of receipt of the agent or toxin. A
copy of the completed form must be maintained for 3 years.

Sec. 121.10 Restricting access to select agents and toxins; security
risk assessments.

(a) An individual or entity required to register under this part
may not provide an individual access to a select agent or toxin, and an
individual may not access a select agent or toxin, unless the
individual is approved by the Administrator or the HHS Secretary
following a security risk assessment by the Attorney General.
(b) An individual will be deemed to have access at any point in
time if the individual has possession of a select agent or toxin (e.g.,
carries, uses, or manipulates) or the ability to gain possession of a
select agent or toxin.
(c) Each individual with access to select agents or toxins must
have the appropriate education, training, and/or experience to handle
or use such agents or toxins.
(d) To apply for access approval, each individual must submit the
information necessary to conduct a security risk assessment to the
Attorney General.
(e) An individual's security risk assessment may be expedited upon
written request by the responsible official and a showing of good cause
(e.g., public health or agricultural emergencies, national security, or
a short-term visit by a prominent researcher). A written decision
granting or denying the request will be issued.
(f) An individual's access approval for VS select agents or toxins
may be denied, limited, or revoked if:
(1) The individual is within any of the categories described in 18
U.S.C. 175b;
(2) The individual is reasonably suspected by any Federal law
enforcement or intelligence agency of committing a crime set forth in
18 U.S.C. 2332b(g)(5); knowing involvement with an organization that
engages in domestic or international terrorism (as defined in 18 U.S.C.
2331) or with any other organization that engages in intentional crimes
of violence; or being an agent of a foreign power as defined in 50
U.S.C. 1801; or
(3) It is determined that such action is necessary to protect
animal health or animal products.
(g) For overlap select agents or toxins, an individual's access
approval will be denied or revoked if the individual is within any of
the categories described in 18 U.S.C. 175b. An individual's access
approval may be denied, limited, or revoked for the reasons set forth
in paragraphs (f)(2) through (f)(3) of this section.
(h) An individual may appeal the Administrator's decision to deny,
limit, or revoke access approval under Sec. 121.20.
(i) Access approval is valid for a maximum of 5 years.
(j) The responsible official must immediately notify APHIS or CDC
when an individual's access to select agents or toxins is terminated by
the entity and the reasons therefore.

Sec. 121.11 Security.

(a) An individual or entity required to register under this part
must develop

[[Page 13290]]

and implement a written security plan. The security plan must be
sufficient to safeguard the select agent or toxin against unauthorized
access, theft, loss, or release.
(b) The security plan must be designed according to a site-specific
risk assessment and must provide graded protection in accordance with
the risk of the select agent or toxin, given its intended use. The
security plan must be submitted upon request.
(c) The security plan must:
(1) Describe procedures for physical security, inventory control,
and information systems control;
(2) Contain provisions for the control of access to select agents
and toxins;
(3) Contain provisions for routine cleaning, maintenance, and
repairs;
(4) Establish procedures for removing unauthorized or suspicious
persons;
(5) Describe procedures for addressing loss or compromise of keys,
passwords, combinations, etc. and protocols for changing access numbers
or locks following staff changes;
(6) Contain procedures for reporting unauthorized or suspicious
persons or activities, loss or theft of select agents or toxins,
release of select agents or toxins, or alteration of inventory records;
and
(7) Contain provisions for ensuring that all individuals with
access approval from the Administrator or the HHS Secretary understand
and comply with the security procedures.
(d) An individual or entity must adhere to the following security
requirements or implement measures to achieve an equivalent or greater
level of security:
(1) Allow access only to individuals with access approval from the
Administrator or the HHS Secretary;
(2) Allow individuals not approved for access by the Administrator
or the HHS Secretary to conduct routine cleaning, maintenance, repairs,
and other activities not related to select agents or toxins only when
continuously escorted by an approved individual;
(3) Provide for the control of select agents and toxins by
requiring freezers, refrigerators, cabinets, and other containers where
select agents or toxins are stored to be secured against unauthorized
access (e.g., card access system, lock boxes);
(4) Inspect all suspicious packages before they are brought into or
removed from an area where select agents or toxins are used or stored;
(5) Establish a protocol for intra-entity transfers under the
supervision of an individual with access approval from the
Administrator or the HHS Secretary, including chain-of-custody
documents and provisions for safeguarding against theft, loss, or
release; and
(6) Require that individuals with access approval from the
Administrator or the HHS Secretary refrain from sharing with any other
person their unique means of accessing a select agent or toxin (e.g.,
keycards or passwords);
(7) Require that individuals with access approval from the
Administrator or the HHS Secretary immediately report any of the
following to the responsible official:
(i) Any loss or compromise of keys, passwords, combinations, etc.;
(ii) Any suspicious persons or activities;
(iii) Any loss or theft of select agents or toxins;
(iv) Any release of a select agent or toxin; and
(v) Any sign that inventory or use records for select agents or
toxins have been altered or otherwise compromised; and
(8) Separate areas where select agents and toxins are stored or
used from the public areas of the building.
(e) In developing a security plan, an individual or entity should
consider the document entitled, ``Laboratory Security and Emergency
Response Guidance for Laboratories Working with Select Agents,'' in
Morbidity and Mortality Weekly Report (December 6, 2002); 51 (No. RR-
19):1-6. This document is available on the Internet at http://www.cdc.gov/mmwr
.

(f) The plan must be reviewed annually and revised as necessary.
Drills or exercises must be conducted at least annually to test and
evaluate the effectiveness of the plan. The plan must be reviewed and
revised, as necessary, after any drill or exercise and after any
incident.

Sec. 121.12 Biosafety.

(a) An individual or entity required to register under this part
must develop and implement a written biosafety plan that is
commensurate with the risk of the select agent or toxin, given its
intended use.\8\ The biosafety plan must contain sufficient information
and documentation to describe the biosafety and containment procedures.
---------------------------------------------------------------------------

\8\ Technical assistance and guidance may be obtained by
contacting APHIS.
---------------------------------------------------------------------------

(b) The biosafety and containment procedures must be sufficient to
contain the select agent or toxin (e.g., physical structure and
features of the entity, and operational and procedural safeguards).
(c) In developing a biosafety plan, an individual or entity should
consider the following:
(1) The CDC/NIH publication, ``Biosafety in Microbiological and
Biomedical Laboratories.'' This document may be obtained from the U.S.
Government Printing Office. It is also available on the Internet at
http://www.aphis.usda.gov/programs/ag_selectagent/index.html.

(2) The Occupational Safety and Health Administration (OSHA)
regulations in 29 CFR 1910.1200 and 1910.1450.
(3) The ``NIH Guidelines for Research Involving Recombinant DNA
Molecules.'' This document is available on the Internet at http://www.aphis.usda.gov./programs/ag_selectagent/index.html
.

(d) The plan must be reviewed annually and revised as necessary.
Drills or exercises must be conducted at least annually to test and
evaluate the effectiveness of the plan. The plan must be reviewed and
revised, as necessary, after any drill or exercise and after any
incident.

Sec. 121.13 Restricted experiments.\9\
---------------------------------------------------------------------------

\9\ For guidance, see the NIH publication, ``NIH Guidelines for
Research Involving Recombinant DNA Molecules.'' This document is
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

---------------------------------------------------------------------------

(a) An individual or entity may not conduct a restricted experiment
with a VS select agent or toxin unless approved by and conducted in
accordance with any conditions prescribed by the Administrator. In
addition, an individual or entity may not conduct a restricted
experiment with an overlap select agent or toxin unless approved by and
conducted in accordance with any conditions prescribed by the
Administrator and the HHS Secretary.
(b) Restricted experiments:
(1) Experiments utilizing recombinant DNA that involve the
deliberate transfer of a drug resistance trait to select agents that
are not known to acquire the trait naturally, if such acquisition could
compromise the use of the drug to control disease agents in humans,
veterinary medicine, or agriculture.
(2) Experiments involving the deliberate formation of recombinant
DNA containing genes for the biosynthesis of toxins lethal for
vertebrates at an LD50 <100 ng/kg body weight.
(c) The Administrator may revoke approval to conduct any of the
experiments in paragraph (b) of this section, or revoke or suspend a
certificate of registration, if the individual or entity fails to
comply with the requirements of this part.
(d) To apply for approval to conduct any of the experiments in
paragraph (b) of this section, an individual or entity must submit a
written request and

[[Page 13291]]

supporting scientific information. A written decision granting or
denying the request will be issued.

Sec. 121.14 Incident response.\10\
---------------------------------------------------------------------------

\10\ Nothing in this section is meant to supersede or preempt
incident response requirements imposed by other statutes or
regulations.
---------------------------------------------------------------------------

(a) An individual or entity required to register under this part
must develop and implement a written incident response plan.\11\ The
incident response plan must be coordinated with any entity-wide plans,
kept in the workplace, and available to employees for review.
---------------------------------------------------------------------------

\11\ Technical assistance and guidance may be obtained by
contacting APHIS.
---------------------------------------------------------------------------

Sec. 121.15 Training.

(a) An individual or entity required to register under this part
must provide information and training on biosafety and security to each
individual with access approval from the Administrator or the HHS
Secretary before he/she has such access. In addition, an individual or
entity must provide information and training on biosafety and security
to each individual not approved for access by the Administrator or the
HHS Secretary before he/she works in or visits areas where select
agents or toxins are handled or stored (e.g., laboratories, growth
chambers, animal rooms, greenhouses, storage areas, etc.). The training
must address the particular needs of the individual, the work they will
do, and the risks posed by the select agents or toxins.\12\
---------------------------------------------------------------------------

\12\ For guidance, see the CDC/NIH publication, ``Biosafety in
Microbiological and Biomedical Laboratories.'' This document is
available on the Internet at http://www.aphis.usda.gov/programs/ag_selectagent/index.html
.

---------------------------------------------------------------------------

(b) Refresher training must be provided annually.
(c) A record of the training provided to each individual must be
maintained. The record must include the name of the individual, the
date of training, a description of the training provided, and the means
used to verify that the employee understood the training.

Sec. 121.16 Transfers.

(a) Except as provided in paragraphs (c) and (d) of this section, a
select agent or toxin may only be transferred to individuals or
entities registered to possess, use, or transfer that agent or toxin. A
select agent or toxin may only be transferred under the conditions of
this section and must be authorized by APHIS or CDC prior to the
transfer.\13\
---------------------------------------------------------------------------

\13\ The requirements of this section do not apply to transfers
within a registered entity (i.e., the sender and the recipient are
covered by the same certificate of registration).
---------------------------------------------------------------------------

(b) In addition to any permit required under part 122 of this
subchapter, a transfer may be authorized if:
(1) The sender:
(i) Has at the time of transfer a certificate of registration that
covers the particular select agent or toxin to be transferred and meets
all the requirements of this part;
(ii) Meets the exemption requirements for the particular select
agent or toxin to be transferred; or
(iii) Is transferring the select agent or toxin from outside of the
United States and meets all import requirements.
(2) At the time of transfer, the recipient has a certificate of
registration that includes the particular select agent or toxin to be
transferred and meets all of the requirements of this part.
(c) A select agent or toxin that is contained in a specimen for
proficiency testing may be transferred without prior authorization from
APHIS or CDC provided that, at least 7 calendar days prior to the
transfer, the sender reports to APHIS or CDC the select agent or toxin
to be transferred and the name and address of the recipient.
(d) On a case-by-case basis, the Administrator may authorize a
transfer of a select agent or toxin not otherwise eligible for transfer
under this part under conditions prescribed by the Administrator.
(e) To obtain authorization for a transfer, APHIS/CDC Form 2 must
be submitted.
(f) The recipient must submit a completed APHIS/CDC Form 2 within 2
business days of receipt of a select agent or toxin.
(g) The recipient must immediately notify APHIS or CDC if the
select agent or toxin has not been received within 48 hours after the
expected delivery time or if the package containing the select agent or
toxin has been damaged to the extent that a release of the select agent
or toxin may have occurred.
(h) An authorization for a transfer shall be valid only for 30
calendar days after issuance, except that such an authorization becomes
immediately null and void if any facts supporting the authorization
change (e.g., change in the certificate of registration for the sender
or recipient, change in the application for transfer).
(i) The sender must comply with all applicable laws governing
packaging and shipping.

Sec. 121.17 Records.

[[Page 13292]]

(ii) The quantity acquired from another individual or entity (e.g.,
containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) Where stored (e.g., building, room, and freezer);
(iv) When moved from storage and by whom and when returned to
storage and by whom;
(v) The select agent used and purpose of use;
(vi) Records created under Sec. 121.16 or 42 CFR 73.16
(Transfers);
(vii) For intra-entity transfers (sender and the recipient are
covered by the same certificate of registration), the select agent, the
quantity transferred, the date of transfer, the sender, and the
recipient; and
(viii) Records created under Sec. 121.19 or 42 CFR 73.19
(Notification of theft, loss, or release);
(2) An accurate, current inventory for each toxin held, including:
(i) The name and characteristics;
(ii) The quantity acquired from another individual or entity (e.g.,
containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) The initial and current quantity amount (e.g., milligrams,
milliliters, grams, etc.);
(iv) The toxin used and purpose of use, quantity, date(s) of the
use and by whom;
(v) Where stored (e.g., building, room, and freezer);
(vi) When moved from storage and by whom and when returned to
storage and by whom, including quantity amount;
(vii) Records created under Sec. 121.16 or 42 CFR 73.16

(Transfers);
(viii) For intra-entity transfers (sender and the recipient are
covered by the same certificate of registration), the toxin, the
quantity transferred, the date of transfer, the sender, and the
recipient;
(ix) Records created under Sec. 121.19 or 42 CFR 73.19
(Notification of theft, loss, or release);
(x) If destroyed, the quantity of toxin destroyed, the date of such
action, and by whom.
(3) A current list of all individuals that have been granted access
approval by the Administrator or the HHS Secretary;
(4) Information about all entries into areas containing select
agents or toxins, including the name of the individual, name of the
escort (if applicable), and the date and time of entry;
(5) Accurate, current records created under Sec. 121.9 or 42 CFR
73.9 (Responsible official), Sec. 121.11 or 42 CFR 73.11 (Security),
Sec. 121.12 or 42 CFR 73.12 (Biosafety), Sec. 121.14 or 42 CFR 73.14
(Incident response), and Sec. 121.15 or 42 CFR 73.15 (Training); and
(6) A written explanation of any discrepancies.
(b) The individual or entity must implement a system to ensure that
all records and databases created under this part are accurate, have
controlled access, and that their authenticity may be verified.
(c) All records created under this part must be maintained for 3
years and promptly produced upon request.

Sec. 121.18 Inspections.

(a) Without prior notification, APHIS must be allowed to inspect
any site at which activities regulated under this part are conducted
and must be allowed to inspect and copy any records relating to the
activities covered by this part.
(b) Prior to issuing a certificate of registration to an individual
or entity, APHIS may inspect and evaluate the premises and records to
ensure compliance with this part.

Sec. 121.19 Notification of theft, loss, or release.

(a) An individual or entity must immediately notify APHIS or CDC
upon discovery of the theft or loss of a select agent or toxin. Thefts
or losses must be reported even if the select agent or toxin is
subsequently recovered or the responsible parties are identified.
(1) The theft or loss of a select agent or toxin must be reported
by telephone, facsimile, or e-mail. The following information must be
provided:
(i) The name of the select agent or toxin and any identifying
information (e.g., strain or other characterization information);
(ii) An estimate of the quantity stolen or lost;
(iii) An estimate of the time during which the theft or loss
occurred;
(iv) The location (building, room) from which the theft or loss
occurred; and
(v) The list of Federal, State, or local law enforcement agencies
to which the individual or entity reported, or intends to report, the
theft or loss.
(2) A completed APHIS/CDC Form 3 must be submitted within 7
calendar days.
(b) An individual or entity must immediately notify APHIS or CDC
upon discovery of a release of a select agent or toxin causing
occupational exposure or a release of a select agent or toxin outside
of the primary barriers of the biocontainment area.
(1) The release of a select agent or toxin must be reported by
telephone, facsimile, or e-mail. The following information must be
provided:
(i) The name of the select agent or toxin and any identifying
information (e.g., strain or other characterization information);
(ii) An estimate of the quantity released;
(iii) The time and duration of the release;
(iv) The environment into which the release occurred (e.g., in
building or outside of building, waste system);
(v) The location (building, room) from which the release occurred;
and
(vi) The number of individuals potentially exposed at the entity;
(vii) Actions taken to respond to the release; and
(viii) Hazards posed by the release.
(2) A completed APHIS/CDC Form 3 must be submitted within 7
calendar days.

Sec. 121.20 Administrative review.

An individual or entity may appeal a denial, revocation, or
suspension of registration under this part. An individual may appeal a
denial, limitation, or revocation of access approval under this
part.\14\ The appeal must be in writing, state the factual basis for
the appeal, and be submitted to the Administrator within 30 calendar
days of the decision. Where the denial, revocation, or suspension of
registration or the denial, limitation, or revocation of an
individual's access approval is based upon an identification by the
Attorney General, the request for review will be forwarded to the
Attorney General. The Administrator's decision constitutes final agency
action.
---------------------------------------------------------------------------

\14\ An entity may not appeal the denial or limitation of an
individual's access to select agents or toxins.

Done in Washington, DC, this 10th day of March, 2005.
Bill Hawks,
Under Secretary for Marketing and Regulatory Programs.
[FR Doc. 05-5063 Filed 3-17-05; 8:45 am]

BILLING CODE 3410-34-P