HHS OIG Data Brief  May 2017  (OEI-04-15-00430) 
CDC Generally Met Its Inspection Goals for the Federal 
Select Agent Program; However, Opportunities Exist To 
Strengthen Oversight 
In this data brief, we examine how the Division of 
Results at a Glance   Select Agents and Toxins (DSAT)part of the 
Centers for Disease Control and Prevention 
  CDC met its goal of performing 
(CDC)oversees the Federal Select Agent 
a Registration Renewal inspection at 
Program (FSAP).  We did this by reviewing 
least once at nearly all entities that 
handle select agents and toxins from  DSATs inspections and observations; Theft, Loss, 
2013 through 2015.  or Release (TLR) events reported by entities that 
  During all inspections, CDC identified  handle select agents and toxins; and compliance 
at least one observationi.e.,  actions from 2013 through 2015. 
an instance of potential regulatory 
 
noncomplianceper entity.  The 
Biosafety and biosecurity incidents at laboratories 
majority of these observations were 
associated with two areas:  Biosafety  involving select agents and toxins have raised 
and Security.  concerns regarding DSAT oversight of entities that 
  In 2015, CDC exceeded its annual goal  handle such substances, as well as the potential 
for 30 percent of its inspections to be  impact to public health and safety.  For instance, in 
unannounced.  In 2013 and 2014, CDC 
May 2015, the Department of Defense 
did not meet this goal, focusing 
acknowledged that one of its laboratories 
instead on announced inspections for 
training purposes.  inadvertently shipped live anthrax-causing 
bacteria.  This event helped spur a July 2015 
  Most entity-reported Theft, Loss, or 
Release (TLR) events were Releases,  congressional hearing on oversight concerns 
one of which resulted in occupational  related to the FSAP. 
illness.  However, nearly 75 percent of 
entities did not report a TLR event to 
This data brief will help strengthen the FSAP by 
CDC from 2013 through 2015.  CDC 
providing new analyses that DSAT can use to 
officials expressed concern that 
entities may be underreporting these  enhance its oversight.  It is intended to 
events.    complement the 2015 Annual Report of the Federal 
  CDC initiated compliance actions for  Select Agent Program, which was issued in 
14 percent of entities; most were  June 2016, as well as the forthcoming 2016 annual 
Referrals to enforcement agencies for 
report, which is expected to be issued in June 
further review. 
2017.1  This data brief is the first of two reports by 
  Draft CDC risk assessment policies 
the Department of Health and Human Services 
evaluate some, but not all, variables 
(HHS), Office of Inspector General (OIG), on 
that can inform the risk that an entity 
poses to public health and safety.   DSATs oversight of entities registered with the 
1 
  FSAP. The second report will provide DSAT with information on the oversight of FSAP-
registered laboratories by responsible officialsthe individuals at each entity who are 
accountable for compliance with regulations for select agents and toxins.2 
BACKGROUND 
The FSAP oversees the possession, use, and 
Exhibit 1: The FSAP Oversight Structure 
transfer of select agents and toxins and is 
jointly managed by HHS and the   
Federal Select Agent Program  
U.S. Department of Agriculture (USDA).  (See  (FSAP) 
Exhibit 1 for the departments, agencies, and 
divisions responsible for providing FSAP 
U.S. Department of 
U.S. Department of 
oversight.)  The FSAP is composed of  Health and Human 
Agriculture 
Services 
DSATpart of CDCand the Agriculture  (USDA) 
(HHS) 
Select Agent Services (AgSAS), part of 
USDAs Animal and Plant Health Inspection 
Animal and Plant 
Service (APHIS).3   Centers for Disease 
Health  
Control and 
Inspection Service  
Prevention 
DSATs role within the FSAP is to regulate  (CDC)  (APHIS) 
 
select agents and toxins that pose a severe risk 
to public health and safety.  AgSASs role 
Division of Select  Agriculture Select 
within the FSAP is to regulate select agents 
Agents and Toxins  Agent Services 
and toxins that pose a severe risk to animal  (DSAT)  (AgSAS) 
and plant health or to animal and plant 
products.   Source:  HHS OIG analysis of the Federal Select Agents 
Program, About Us. Accessed at 
https://www.selectagents.gov/about.html on February 15, 2017.  
In addition to its FSAP management and 
oversight responsibilities, CDC has laboratories that are registered with the FSAP.  To avoid 
concerns of CDC self-regulation, these laboratories are inspected by AgSAS.  Hereinafter, 
references to CDC pertain to DSATs oversight role within the FSAP, unless otherwise 
specified.  In addition, the focus of this review is on the HHS responsibilities of the FSAP, as 
they are the only portion of the FSAP under HHS OIGs authority.     
DSAT regulates biological agents and toxins that pose a severe risk to public health and safety so 
that research to improve the detection, prevention, diagnoses, and treatment options for diseases 
is conducted as safely and securely as possible.  In fiscal year 2016, DSAT received 
approximately $21.5 million to provide FSAP oversight.4 
An entity that possesses, uses, or transfers select agents and toxins must register with the FSAP 
by submitting an application to DSAT.5  On this application, the entity must list all of its 
laboratories that handle select agents and toxins.  DSAT reviews these applications, inspects the 
associated laboratories, and grants approval when all of the FSAP requirements for working 
safely and securely with select agents and toxins are met.     
All registered entities and their laboratories that handle select agents and toxins must comply 
with FSAP regulations in 42 CFR part 73.6  When conducting inspections, DSAT staff focus their 
review on 13 of 22 regulatory sections.  (See Appendix A for a list of these 13 sections.)  Each of 
2 
  the 13 sections has multiple subsections that further delineate the requirements within the 
section.  According to DSAT, it also uses the Biosafety in Microbiological and Biomedical 
Laboratories guide and the NIH [National Institutes of Health] Guidelines for Research 
Involving Recombinant or Synthetic Nucleic Acid Molecules (NIH Guidelines) to identify 
observationsi.e., instances of potential noncompliance with regulationsthat fall under 
biosafety regulations at 42 CFR  73.12.7, 8   
DSAT categorizes entities as one of five organization types:  Government Non-Federal, 
Academic, Commercial, Government Federal, and Private Nonprofit.9  (See Exhibit 2 for the 
percentages of the 275 entities registered with DSAT by entity type, from 2013 through 2015.)     
Exhibit 2: Percentage of Entities Registered With  DSAT provides oversight of the FSAP 
DSAT by Entity Type, 20132015  through three primary mechanisms.  First, 
DSAT inspects entities to ensure that they 
comply with regulations.  If DSAT 
identifies potential noncompliance with 
Academic regulations during these inspections, it 
31%
Government  identifies them as observations.  Second, 
Non-Federal DSAT reviews all entity reports of TLR 
n = 275 33%
events and assesses each event to 
Commercial 
determine whether additional action is 
Private  16%
Nonprofit required.  Third, DSAT initiates 
5% Government  compliance actions to address serious or 
Federal
repeated potential noncompliance with 
15%
regulations regarding select agents and 
toxins, such as the theft of, loss of, and/or 
Source: HHS OIG analysis of DSAT data, 2016. 
exposure to select agents and/or toxins. 
DSAT Inspections and Observations  
Announced and unannounced onsite inspections are one of the tools that DSAT uses to ensure 
that entities are complying with FSAP regulations.  According to DSAT officials, DSATs goal is 
for unannounced inspections to constitute approximately 30 percent of all inspections that DSAT 
conducts annually.  However, DSAT does not have a formal policy for determining whether an 
inspection should be announced or unannounced.   
 
Additionally, DSAT officials have different protocols for different types of inspections.  For 
instance, the inspection checklist varies according to the type of inspection, as does the list of 
entity staff who are required to be present.  DSAT officials also set a goal for DSAT to perform 
a Registration Renewal inspection at each entity every 3 years.  Exhibit 3 describes the eight 
types of DSAT inspections and notes whether DSAT performs announced or unannounced 
inspections by each type. 
 
DSAT uses teams to conduct inspections.  Each team member has certain responsibilitiesfor 
example, reviewing entity records to determine whether an entity is compliant with all sections 
of regulations regarding select agents and toxins, or drafting a report of inspection findings.  All 
inspectors must complete required training before they can inspect entities.  This requirement is 
3 
  intended to ensure that inspectors correctly identify observations and understand entity processes 
for working with select agents and toxins. 
Exhibit 3:  Types of DSAT Inspections 
Inspection Type  Announced  Unannounced  Description 
A routine review of laboratory spaces and documents for an entity that is 
New Entity  X   
submitting a new application to work with select agents and toxins. 
A routine review of an entitys entire program, including all registered 
Registration Renewal  X  X  laboratories and documents.  DSATs goal is to conduct a Registration 
Renewal inspection at each entity every 3 years.   
A routine review of new laboratory space and documents after the new 
New Space  X   
laboratory space is added to an entitys existing registration. 
A routine annual review of an entitys entire program, including laboratory 
spaces and documents, for laboratories that work with select agents and 
Maximum Containment  X    toxins requiring the highest levels of containment.  A Maximum 
Containment inspection and a Registration Renewal inspection may both be 
conducted in the same year.   
A nonroutine inspection used to verify that an entity has resolved 
Verification   X  X 
observations identified in a previous Registration Renewal inspection.   
A nonroutine inspection initiated on the basis of a specific complaint of 
Investigation  X  X 
severe regulatory noncompliance.   
A nonroutine inspection initiated on the basis of a specific compliance issue 
Compliance  X  X 
(e.g., TLR events or a complaint).   
A nonroutine inspection conducted to verify that an entitys unresolved 
Reinspection  X  X 
compliance issue has been successfully addressed.   
Source:  HHS OIG analysis of the 2015 Annual Report of the Select Agent Program and DSAT data, 2016. 
After completing an inspection, DSAT inspectors brief entity management about any 
observations identified during the inspection.  In addition, DSAT inspectors provide a written 
report to the entity that contains the observationscategorized according to the 13 regulatory 
sections that DSAT reviews when conducting inspectionsand reasons for the observations.   
Theft, Loss, or Release Events   
Exhibit 4:  Formal Types of TLR Events 
An entity is required to report to DSAT any 
TLR eventsi.e., Theft, Loss, or Release  Event Type  Description 
incidents that may pose a risk to public 
Unauthorized removal of a select agent or toxin 
health and safetythat occur there.   Theft 
from an entity 
Exhibit 4 provides definitions for these 
Failure to account for a select agent or toxin at 
event types.  Examples of events that must  Loss  
an entity 
be reported include an inventory 
Occupational exposure or discharge of a select 
discrepancy; a tear in a glove or 
Release  agent or toxin outside the primary barriers of 
containment suit; and a release of select 
a biocontainment area   
agents and toxins that results in 
Source:  DSAT, 2015 Annual Report of the Select Agent Program, 
occupational exposure.    2016 
4 
  In addition to these three formal types of TLR events identified in Exhibit 4, there are some 
reported TLR events that DSAT categorizes as Incidents.  DSAT uses this term if the reported 
event does not fit any of the existing TLR definitions but has the potential for Theft, Loss, or 
Release.  For example, if an entity identified an air leak from a biocontainment area that did not 
contain a select agent or toxin, DSAT may categorize it as an Incident (rather than as a Release).  
An entity must report TLR events to DSAT immediately once it identifies them.10  An entity may 
identify TLR events on its own, or DSAT inspectors may identify TLR events during an 
inspection.  DSAT expressed concern that entities with no reported TLR events for multiple 
years may be underreporting and pose more of a risk than entities that reported TLR events.   
In December 2016, CDC proposed to revise the form that entities use to report TLR events to 
further clarify what needs to be reported to CDC or APHIS as a Release or Loss.  Other proposed 
revisions to the form include additional fields to assist CDC and APHIS with categorizing the 
type of release, type of exposure, and the understanding of safety and security risk levels relative 
to human illness.11 
DSAT is responsible for reviewing all entity reports 
Exhibit 5: TLR Occupational Risk Categories 
of TLR events and categorizing each into one of 
four occupational risk categories.  Occupational  TLR Occupational Risk Categories 
risk categories range from Minimal/No Exposure 
Minimal/No Exposure 
to Occupational Illness (i.e., illness resulting 
from exposure to a select agent or toxin).  (See  Potential Exposure 
Exhibit 5 for DSATs four TLR occupational risk 
Possible Occupational Illness 
categories.)  Depending on the TLR event (i.e., for 
urgent or time-sensitive cases), DSAT may conduct  Occupational Illness 
followup inspections to ensure staff safety.   
Source: HHS OIG analysis of DSAT data, 2016. 
Compliance Actions 
DSAT initiates compliance actions to address  Exhibit 6:  Types of Compliance Actions 
serious or repeated observations and/or TLR events.  
Types of Compliance Actions That DSAT Initiates 
DSAT reviews current and past inspection reports 
and other documents to determine whether an entity 
Application Registration Denials 
should be subject to one or more compliance 
actions.12  (See Exhibit 6 for the five types of  Corrective Action Plans 
compliance actions.)   
Registration Suspensions 
Application Registration Denials.  In instances in 
Registration Revocations 
which DSAT determines that an entity applying to 
register with the FSAP does not meet the regulatory  Referrals 
criteria to possess, use, or transfer select agents and       To AgSAS  
toxins, DSAT may deny the entitys application.13        To the Federal Bureau of Investigation (FBI) 
     To HHS OIG  
An entity may submit a new application to the 
FSAP if it wants to register with the program after a  Source: DSAT, 2015 Annual Report of the Select Agent 
Program. 
previous application has been denied. 
5 
  Corrective Action Plans.  When DSAT identifies systemic and/or severe observations or TLR 
events at an entity, it may propose that the entity participate in a Corrective Action Plan.  The 
Corrective Action Plan allows an entity to develop steps to address the observations.  The 
Corrective Action Plan also allows DSAT to provide technical assistance and monitor progress 
in correcting the observations.14  An entity may choose whether to participate in a Corrective 
Action Plan.  If an entity chooses not to participate in a Corrective Action Plan, DSAT will 
initiate stronger compliance actions (i.e., registration suspension or revocation) to address the 
observations at the entity.  
Registration Suspensions.  In instances in which DSAT determines through an inspection that an 
entity does not meet the regulatory criteria to possess, use, or transfer select agents and toxins, 
DSAT may suspend the entitys registration.15  DSAT determines the conditions of such 
a suspensioni.e., the issues the entity needs to addressand determines when the entity has 
fully addressed the conditions leading to the suspension and is thus eligible for its registration to 
be reinstated. 
Registration Revocations.  In instances in which DSAT determines that a registered entity does 
not meet regulatory criteria to possess, use, or transfer select agents and toxins, DSAT may also 
revoke an entitys registration.16  According to DSAT, an entity may submit a new application to 
the FSAP if it wants to reregister with the program after its registration is revoked. 
Referrals.  DSAT may refer entities to one of three enforcement agencies for further investigation 
of possible violations of Federal criminal law and/or regulations regarding select agents and 
toxins.17  The enforcement agencies are AgSAS, the Federal Bureau of Investigation (FBI), and 
HHS OIG. 
When CDC laboratory staff notify DSAT of possible violations involving CDC laboratories, 
DSAT refers the possible violations to AgSAS, to avoid the appearance of a conflict of interest.  
DSAT also refers cases involving other entity types to AgSAS if they appear to violate USDA 
regulations.  
DSAT refers to the FBI possible criminal violations, such as knowingly submitting a false 
document to DSAT or unlawfully possessing select agents or toxins. 
DSAT may also refer to HHS OIG potential violations of regulations at 42 CFR part 73.  HHS 
OIG has the authority to impose civil monetary penalties on entities for violating 42 CFR 
part 73.      
Risk Assessment in the Federal Select Agent Program 
All Federal agencies are required to integrate risk management activities into their existing 
practices.  Specifically, the Office of Management and Budget Circular No. A-123 requires 
agencies to integrate risk management and internal control functions.18  The Circular also 
establishes an assessment process based on the Government Accountability Offices Standards 
for Internal Control in the Federal Government that agencies must implement to assess and 
improve internal controls.  A 2015 CDC internal review of the FSAP contained several 
recommendations to help DSAT better align program risk-assessment activities to improve 
program performance.19  These recommendations included prioritizing enforcement actions 
6 
  according to the risk level of the violation, and analyzing trends and associations between 
inspection findings and risk.   
Methodology 
We analyzed FSAP regulations, DSAT documents, and DSAT data to calculate the numbers and 
types of inspections, observations, TLR events, and compliance actions from 2013 through 2015.  
We also interviewed DSAT staff and obtained draft DSAT and FSAP policies to learn about 
current and planned program policies, goals, and oversight activities.  See Appendix B for more 
details on our methodology.   
 
 
 
   
7 
  RESULTS 
 
CDC met its goal of performing a Registration Renewal 
inspection at least once at nearly all entities over a 3-year 
period
 
During our review period2013 through 2015CDCs DSAT inspected all 275 entities 
registered with the FSAP, conducting a total of 500 inspections.  The number of inspections per 
entity ranged from 1 to 14, with a median of 2 inspections per entity.20 Additionally, for the 
233 entities that were continuously registered with the FSAP during the 3-year period of our 
review, DSAT met its goal of performing a Registration Renewal inspection for nearly all of 
them (227 of 233).  The six entities that did not receive a Registration Renewal inspection did 
receive at least one other type of inspection during this period.21   
Fifty-five percent of the inspections that DSAT conducted from 2013 through 2015 were 
Registration Renewal inspections, and 26 percent were Verification inspections.  The remaining 
19 percent of inspections that DSAT conducted were composed of the six other inspection types.   
Exhibit 7 below and Exhibit C-1 in Appendix C show the number and percentage of entities 
inspected by inspection type per year from 2013 through 2015.   
Exhibit 7: Number and Percentage of Inspections by Inspection Type, 20132015  
0 50 100 150 200 250 300
Registration Renewal, 
273(55%)
Verification, 130(26%)
s
n
o New Space, 26(5%)
cti
pe Compliance, 25(5%)
s
n
of I Maximum Containment, 20(4%)
e  Reinspection, 14(3%)
p
y
T
New Entity, 10(2%)
Investigation, 2(<0.5%)
Total Inspections = 500
Source: HHS OIG analysis of DSAT data, 2016. 
 
The number of entities that DSAT inspected per year varied a small amount across the 3-year 
period of our review.  Specifically, the number of entities inspected increased between 2013 and 
2014, from 145 to 161 (an 11-percent increase).  In 2015, the number of entities inspected 
decreased by 11 percent, back to levels similar to those in 2013.  CDC reported that this decrease 
stemmed from a shortage of inspectors available to perform inspections in 2015 relative to the 
number of inspectors available in 2014.  Exhibit 8 shows the number of entities inspected, by 
year, from 2013 through 2015.   
8 
  Exhibit 8: Number of Entities Inspected, by Year, 20132015 
180
d160
e
ct
e140
p
s
n
s I120
e
ntiti100
E
of  80 161
er  145 144
b
m 60
u
N
40
20
0
2013 2014 2015
Source: HHS OIG analysis of DSAT data, 2016.  
Note: In some cases, DSAT inspected the same entities multiple times. 
Sixty-one percent of observations that CDC identified were 
associated with two areas:  Biosafety and Security
 
Sixty-one percent of the observations that CDCs DSAT identified during inspections at entities 
were associated with two areas:  Biosafety and Security.  DSAT identified 8,111 observations 
during its 500 inspections of entities registered with the FSAP from 2013 through 2015.  These 
8,111 observations represented potential noncompliance with 11 of the 13 regulatory sections 
pertaining to select agents and toxins that DSAT reviews during its inspections.  Exhibit 9 shows 
the percentage of observations identified per regulatory section (42 CFR  73.7 through 73.19) 
from 2013 through 2015.  Appendix D shows the number of observations identified by 
regulatory section and subsection from 2013 through 2015. 
 
DSAT identified at least one observation at each inspected entity.  The number of observations 
per entity ranged from 2 to 161, with a median of 22 observations per entity.22  Observations 
relating to two regulatory sectionsBiosafety (42 CFR  73.12) and Security (42 CFR 
 73.11)accounted for 61 percent (4,923 of 8,111) of all DSAT observations.   
 
The most commonly cited regulatory area pertained to Biosafetythe requirements for entities 
to have adequate biosafety containment of select agents and toxins (42 CFR  73.12).  
Observations in this area accounted for 31 percent (2,554 of 8,111) of all observations.  Of the 
observations associated with Biosafety, the most common observations identified (1,857 of 
2,554, or 73 percent) were associated with departures from the Biosafety in Microbiological and 
Biomedical Laboratories guide or the NIH Guidelines.   
The next most commonly cited regulatory area pertained to Securitythe requirements for 
entities security (42 CFR  73.11).  Observations in this area accounted for 29 percent (2,369 of 
9 
  8,111) of all observations.  Of the observations associated with Security, the most common 
observations identified (268 of 2,369, or 11 percent) were associated with deficiencies in the 
procedures for informing the responsible official and other appropriate agencies of suspected 
criminal activity.  
 
Exhibit 9: Percentage of Observations Identified by FSAP Regulation Section, 20132015 
 
0% 5% 10% 15% 20% 25% 30% 35%
Biosafety (42 CFR  73.12) 31%
Security (42 CFR  73.11) 29%
Incident Response (42 CFR  73.14) 13%
Records (42 CFR  73.17) 13%
Training (42 CFR  73.15) 7%
Responsible Official (42 CFR  73.9) 3%
Registration and Related Security Assessments (42 CFR  73.7) 2%
Transfers (42 CFR  73.16) 1%
Notification of Theft, Loss, Release (42 CFR  73.19) <0.5%
Restricting Access to Select Agents and Toxins;
<0.5%
Security Risk Assessments (42 CFR  73.10)
Restricted Experiments (42 CFR  73.13) <0.01%
Denial, Revocation, or Suspension of Registration (42 CFR  73.8) 0%
Inspections (42 CFR  73.18) 0%
Source: HHS OIG analysis of DSAT data, 2016.  
Note:  Because of rounding, the sum of Biosafety observations and Security observations in this Exhibit does not equal 61 percent.    
CDC met its annual goal for unannounced inspections for 
1 of the 3 years we reviewed  
CDCs DSAT officials set a goal for  Exhibit 10: Numbers of Announced and Unannounced 
unannounced inspections to constitute  Inspections, 20132015  
approximately 30 percent of all the  200
inspections DSAT performed annually.   180
15 9%
Exhibit 10 shows the number of announced  160
s 14 9%
and unannounced inspections performed  on 140
cti 120 66    40%
each year and the percentage of inspections  e
p
s 100
t2h0a1t5 w. e  re unannounced from 2013 through  er of In 6800 145 161
mb 99
40
u
In 2015, DSAT exceeded its annual goal,  N
20
as 40 percent (66 of 165) of all inspections  0
were unannounced.  In 2013 and 2014,  2013 2014 2015
DSAT did not meet this goal Announced Inspections Unannounced Inspections
unannounced inspections accounted for  Source: HHS OIG analysis of DSAT data, 2016.  
10 
  9 percent (14 of 159) of all inspections in 2013, and also for 9 percent (15 of 176) of all 
inspections in 2014.  DSAT officials reported that they conducted more announced inspections in 
2013 and 2014 to provide assistance and education on regulations updated in October 2012 to a 
larger number of entity staff.23  According to DSAT, more entity staff are generally present at 
announced inspections than at unannounced inspections.    
The median number of observations identified by announced and unannounced inspections 
varied by inspection type.  The median number of observations resulting from announced 
inspections was slightly more (13) than the median number of observations resulting from 
unannounced inspections (10).  However, unannounced inspections yielded a higher median 
number of observations per inspection than announced inspections for Registration Renewal 
inspections and Compliance inspections.  Exhibit 11 shows the number and median number of 
observations identified from announced and unannounced inspections for all inspection types 
from 2013 through 2015.  Additionally, see Exhibit C-2 in Appendix C for the average number 
of observations per inspection by inspection type. 
Exhibit 11: Number of Announced and Unannounced Inspections and the Number and Average Number of Observations 
Identified From These Inspections By Inspection Type, 20132015 
Number of   Number of   Median Number of 
Inspection Type  Inspections  Observations  Observations Per Inspection 
Announced  Unannounced  Announced  Unannounced  Announced  Unannounced 
Registration Renewal  262  11  4,516  297  13  22 
Verification  66  64  1,126  771  14  9 
Compliance  5  20  22  237  5  9 
Reinspection  14  0  169  0  13  n/a 
Investigation  2  0  17  0  9  n/a 
Maximum Containment  20  n/a  198  n/a  9  n/a 
New Space  26  n/a  433  n/a  10  n/a 
New Entity  10  n/a  325  n/a  33  n/a 
Total  405  95  6,806  1,305  13  10 
Source: HHS OIG analysis of DSAT data, 2016. 
Most of the TLR events reported by entities were Releases, 
one of which resulted in occupational illness 
From 2013 through 2015, 27 percent of entities (74 of 275) reported a total of 341 TLR events; 
however, CDCs DSAT determined that only 1 of these TLR events resulted in occupational 
illness.  Of the entities that reported at least 1 TLR event during our 3-year review period, the 
median number reported was 2 and the range was 1 to 56. 24  Eighty-four percent of the 341 TLR 
events were reported as Releases.  The remaining TLR events were either reported by entities as 
Losses or were categorized by DSAT as Incidents.  During the 3-year period of our review, 
entities did not report any instances of Theft.  Exhibit 12 shows the type, number, and percentage 
of TLR events from 2013 through 2015.  Additionally, Exhibit C-2 in Appendix C shows the 
type, number, and percentage of TLR events by year, 2013 through 2015. 
11 
  Exhibit 12: Type, Number, and Percentage of TLR Events and Incidents, 2013 through 2015  
Type of TLR Events  Number of TLR Events  Percentage of Total TLR Events 
Release  287  84%* 
     Release Outside Primary Containment  88  26% 
     Spills  69  20% 
     Personal Protective Equipment Failure   53  16% 
     Other Releases  77  23% 
Loss  37  11% 
     Inventory Discrepancy  24  7% 
     No Documentation of Missing Select Agents and/or Toxins  12  4% 
     Loss of Vials During Transport  1  <0.01% 
Incident  17  5% 
Theft  0  0% 
TOTAL  341  100% 
Source:  HHS OIG analysis of DSAT data, 2016. 
*Note: The sum of the percentages of the Release types exceeds the total percentage of Releases because of rounding. 
Additionally, 73 percent of entities (201 of 275) did not report any TLR events during the 3-year 
period of our review.  DSAT expressed concern that entities with no reported TLR events for 
multiple years may be underreporting and pose more of a risk than entities that reported TLR 
events.   
Releases  
From 2013 through 2015, entities reported 287 Releases to DSAT.  The majority of these 
reported releases involved one of three scenarios. 
 
The most common scenario (88 Releases) involved the release of an agent outside a primary 
containment area.  For example, one entity reported that while conducting inventory of select 
agents and/or toxins, staff identified a broken lid on a frozen vial that contained a select agent.   
 
The second-most common scenario (69 Releases) involved spills.  For example, one entity 
reported that approximately 200 ml of a select agent had leaked from a defective part of a 
chemical mixing barrel, which potentially exposed staff to harmful neurotoxins.   
  
The third most common scenario (53 Releases) involved the failure of personal protective 
equipment, such as gloves or masks.  For example, one entity reported that a staff member 
identified a tear in a glove after conducting experiments with the Ebola virus. 
The remaining Releases (77) involved a variety of other instances in which select agents and/or 
toxins were inadvertently released outside primary barriers in biocontainment areas but within 
protected lab spaces. 
12 
  Of the 287 Releases, DSAT determined that 1 event resulted in an occupational illness.  This 
Release occurred during transport when plates containing a select agent spilled and exposed 
a worker to the agent.  According to DSAT, the worker tested positive for antibodies indicating 
an infection, received treatment, and was placed on routine monitoring.  Of the remaining 
286 Releases, DSAT categorized 2 as a Possible Occupational Illness, 283 as a Potential 
Exposure, and the remaining event as Minimal/No Exposure.   
Losses   
From 2013 through 2015, entities reported 37 Losses to DSAT.  The majority of Losses (24) 
were due to inventory discrepancies.  Examples of inventory discrepancies included entities not 
being able to (1) account for vials of select agents and/or toxins when comparing physical vials 
to those listed in storage databases or (2) locate vials to use for an experiment.  The remaining 
13 Losses resulted from not having documentation of missing or discarded select agents and/or 
toxins or were for vials that were lost during transport.  The lost vials were later fully recovered, 
and the container had not been breached.  
DSAT categorized all but 1 of the 37 losses as resulting in Minimal/No Exposure.  DSAT 
categorized the remaining Loss as a Potential Exposure.  In this instance, an insect infected with 
a select agent could not be located.  However, DSAT investigated the event and determined that 
no exposure occurred and that the reported loss likely resulted from an inaccurate count by the 
entity rather than a post-exposure escape of the insect. 
Incidents   
DSAT categorized 17 TLR events reported by entities from 2013 through 2015 as Incidents.  
Examples of Incidents included a laboratory worker at an entity who suffered a small abrasion to 
the shin while swapping out storage racks in a select agent laboratory.  In another example, an 
entity could not locate a select agent vial in its inventory and reported this to DSAT; however, 
the entity located the vial shortly after reporting the event, so DSAT categorized it as an Incident 
rather than a Loss.   
DSAT categorized 12 of the 17 Incidents as resulting in Minimal/No Exposure and categorized 
the remaining 5 Incidents as Potential Exposures.  For example, a small dried spot, possibly from 
a select-agent spill, was noted under a culture tank and was therefore categorized as a potential 
exposure. 
CDC initiated 70 compliance actions for 40 entities from 2013 
through 2015; most were Referrals to enforcement agencies 
for further review
 
CDCs DSAT can initiate one or more compliance actions to address serious or repeated 
observations and/or TLR events.  DSAT initiated 70 compliance actions for 40 entities from  
2013 through 2015.  For these entities, the number of compliance actions during our review 
period ranged from 1 to 10.  The compliance actions that DSAT initiated were Referrals, 
Corrective Action Plans, and Registration Suspensions.  DSAT did not initiate any other type of 
compliance actions (i.e., Application Registration Denials or Registration Revocations).  
Exhibit 13 shows the type, number, and percentage of compliance actions initiated from 2013 
13 
  through 2015.  Additionally, Exhibit C-3 in Appendix C shows the type, number, and percentage 
of compliance actions per year by type of compliance action, 2013 through 2015. 
Fifty of the 70 compliance actions (71 percent) from 2013 through 2015 were Referrals to 
enforcement agencies (i.e., AgSAS, FBI, and HHS OIG).  Each of DSATs Referrals to AgSAS 
and the FBI were based on either (1) TLR events at entities that reported being unable to locate 
one or more select-agent vials listed in their inventory or (2) incidents related to the use or 
storage of select agents and/or toxins.  The 25 Referrals to AgSAS involved 9 entities, including 
1 CDC laboratory.  All of the Referrals to AgSAS and the FBI have been closed and did not 
result in additional action (e.g., criminal charges or other compliance action).  Six Referrals were 
sent to HHS OIG and involved five entities.  As of May 2017, HHS OIG had closed five of these 
six Referrals.   
Exhibit 13:  Type, Number, and Percentage of Compliance Actions Initiated From 2013 through 2015   
Type of   Number of   Number of   Percentage of  
Compliance Action  Compliance Actions   Entities*  Compliance Actions 
Referral  50  27  71%** 
     To AgSAS   25  9  36% 
     To FBI   19  15  27% 
     To HHS OIG   6  5  9% 
Corrective Action Plan  16  16  23% 
Registration Suspension  4  4  6% 
Application Registration Denial  0  0  0% 
Registration Revocation  0  0  0% 
Total  70  40  100% 
Source:  HHS OIG analysis of DSAT data, 2016. 
*Note:  Column sum exceeds total because DSAT initiated multiple compliance actions for some entities.  
**Note:  The sum of the percentages of the Referral types exceeds the total percentage of Referrals because of rounding.   
 
Sixteen of the 70 compliance actions that DSAT initiated from 2013 through 2015 resulted in 
Corrective Action Plans.  Entities voluntarily agreed to participate in these Corrective Action 
Plans for several reasons.  For example, one entity was not providing adequate training to 
individuals with access to select agents and toxins, as required by the regulations.  The entity and 
DSAT jointly developed a plan to improve training.  Of the 16 entities that participated in 
a Corrective Action Plan, 12 had successfully completed them as of December 2016.   
Finally, DSAT initiated four Registration Suspensions from 2013 through 2015.  These 
Registration Suspensions occurred for several reasons.  One entity failed to ensure that biosafety 
and containment procedures could properly contain select agents and toxins, and another had 
several observations related to training, records management, and/or security.  The remaining 
entities had their registrations suspended for performing unauthorized transfers or allowing 
unauthorized access to select agents and toxins.  All entities that received Registration 
Suspensions have been reinstated to the FSAP. 
14 
  Draft CDC risk assessment policies evaluate some, but not 
all, variables that can inform the risk an entity poses to 
public health and safety
 
All Federal agencies are required to integrate risk management activities into their existing 
practices per the Office of Management and Budget Circular No. A-123 and the Government 
Accountability Offices Standards for Internal Control in the Federal Government.  In addition, 
the 2015 CDC internal review of the FSAP contained several recommendations to help DSAT 
better align program risk-assessment activities to improve program performance.  
CDC has taken some action to address these requirements and recommendations to assess 
program risk to public health and safety.  As of February 2016, DSAT had several draft policies 
that, when finalized, are intended to assess an entitys risk to public health and safety.  For 
example, DSAT was working with AgSAS to draft a policy to identify observations as serious, 
moderate, and low risk.  This draft policy will assist DSAT in establishing consistent practices 
for determining the type and timing of compliance actions for an entity on the basis of the 
observations identified at the entity.   
DSAT has also drafted methods for calculating entity risk scores on the basis of an entitys 
complexity.  DSAT plans to consider several factors (e.g., entity size, Biosafety Level) to 
indicate complexity.25  DSAT plans to use these entity risk scores to determine the timing of 
future inspections at entities.   
However, DSAT has not yet integrated these risk management activities into a broader profile of 
entity risk.  For example, DSAT has not developed a method for compiling all information about 
an entity on the basis of these draft policies or other information (e.g., whether an entity has 
previously reported TLR events, what the risk associated with any reported TLR events was, or 
whether the entity was subject to a compliance action) over time. 
   
15 
  CONCLUSION
 
 
CDCs DSAT is responsible for ensuring that entities possessing, using, or transferring select 
agents and toxins comply with FSAP regulations.  If an entity is not meeting FSAP regulations, 
the entity may pose a risk to public health and safety.   
 
We found that DSAT met its goal of performing a Registration Renewal inspection at least once 
at nearly all entities in our review registered with the FSAP from 2013 through 2015.  We also 
found that 61 percent of observations that DSAT identified from 2013 through 2015 were 
associated with two sections in the FSAP regulations:  Biosafety and Security.  Therefore, DSAT 
could consider developing additional guidance and training to address entities vulnerabilities in 
these areas.   
 
Additionally, in 2015 DSAT exceeded its goal for unannounced inspections to constitute 
approximately 30 percent of the inspections that it conducts annually; it conducted unannounced 
inspections four times more than in 2014 or 2013.  DSAT did not meet this goal in 2013 or 2014 
because it focused on providing assistance and education on regulations updated in October 2012 
to a larger number of entity staff by conducting a higher percentage of announced inspections, as 
more entity staff are present for announced inspections.  Unannounced inspections yielded a 
higher median number of observations per inspection than announced inspections for 
Registration Renewal inspections and Compliance inspections.  Therefore, DSAT could analyze 
whether unannounced inspections are more effective than announced inspections in identifying 
observations and enforcing FSAP regulations for certain types of inspections.  DSAT could use 
these results in setting its future goals for unannounced inspections by inspection type. 
 
We also found that entities reported 341 TLR events to DSAT during this timeframe, and that 
most of these TLR events were Releases.  While only one of the TLR events resulted in 
occupational illness, DSAT could consider monitoring the frequency of the types of TLR events 
to guide future training and development efforts.  DSAT could also consider looking more 
closely at those entities with no reported TLR events for multiple years, as DSAT has raised 
concerns that this may indicate a culture of underreporting such events and pose more of a risk 
than entities that do report TLR events.  Not reporting TLR events may also indicate a lack of 
understanding of when and whether to report TLR events, so DSAT may also want to consider 
developing further guidance to entities on these topics.    
 
Finally, DSAT has taken some action to address the requirements in the Office of Management 
and Budgets Circular No. A-123 and specific recommendations from DSATs 2015 internal 
review.  The risk-assessment policies that DSAT drafted, when finalized, are intended to provide 
information on how DSAT assesses and mitigates risk in the FSAP.  However, we found that 
DSATs draft policies evaluate some, but not all, variables that could inform the risk that an 
entity poses to public health and safety.  Establishing effective risk assessment policies is an 
important way that DSAT can ensure that it has a robust system to develop program activities 
that appropriately address risk.  As DSAT finalizes its draft policies and integrates these risk 
management activities into a broader risk profile for entities, it may wish to enhance its risk 
assessment by considering additional factors that may inform an entitys level of risk over time.  
 
16 
  This is the first of two related HHS OIG reports on DSATs oversight of laboratories registered 
with the FSAP.  The second report will provide DSAT with information on responsible officials 
 
oversight of laboratories registered with the FSAP.
 
   
17 
  APPENDIX A 
 
 
The 13 Federal Regulatory Sections for Select Agents and Toxins That DSAT 
Reviews When Conducting Inspections  
(42 CFR  Part 73) 
              
Registration and Related Security Risk Assessments.............................................42 CFR  73.7 
Denial, Revocation, or Suspension of Registration..............................................................42 CFR  73.8 
Responsible Official....................................................................................42 CFR  73.9 
Restricting Access to Select Agents and Toxins; Security Risk Assessments..................42 CFR  73.10 
Security....................................................................................................42 CFR  73.11 
Biosafety...........................................................................................................42 CFR  73.12 
Restricted Experiments...................................................................................42 CFR  73.13 
Incident Response.......................................................................................42 CFR  73.14 
Training..................................................................................................42 CFR  73.15 
Transfers................................................................................................................................42 CFR  73.16 
Records.........................................................................................................42 CFR  73.17 
Inspections..............................................................................................42 CFR  73.18 
Notification of Theft, Loss, or Release..............................................................42 CFR  73.19 
 
 
 
 
 
 
 
 
 
 
 
 
 
18 
  APPENDIX B  
 
Detailed Methodology 
 
We analyzed FSAP regulations, DSAT policy documents, and data in the National Select Agent 
Registry (NSAR) database that we received from DSAT.  The NSAR database contains 
information about all FSAP inspections, observations, TLR events, and compliance actions 
during our review period, 2013 through 2015.  We also interviewed DSAT staff and obtained 
draft DSAT and FSAP policies to learn about current and planned program policies, goals, and 
oversight activities.   
 
Our analysis included activities performed by DSAT for entities (including CDC laboratories) 
that were registered with the FSAP at any point during our review period.  A subset of our 
analysis included only those entities registered with the FSAP during the full 3-year period of 
our review.  We excluded entities from all of our analyses if they were registered with the FSAP 
but had only select agents and toxins that were under USDA oversight.   
 
Number and Type of Inspections That DSAT Performed   
We analyzed spreadsheets from the NSAR database to calculate the number and type of 
inspections that DSAT performed at entities registered with the FSAP.  We also calculated the 
median and average number and percentage of these inspection types.  Additionally, we 
calculated the number of entities that were continuously registered with the FSAP from 2013 
through 2015, so we could determine whether DSAT performed a Registration Renewal 
inspection for each of these entities.  We collected any policies that described how DSAT 
determines the type or timeframe of future inspections.   
 
Number of and Reasons for Observations That DSAT Identified 
We analyzed spreadsheets from the NSAR database to calculate the number of observations that 
DSAT found from 2013 through 2015 and to identify the regulatory sections corresponding to 
these observations.  We also identified how many observations resulted from potential 
noncompliance with other sources, such as the Biosafety in Microbiological and Biomedical 
Laboratories handbook or the NIH Guidelines.  We calculated the median and average number 
and percentage of observations.  We analyzed the number of observations that DSAT identified 
on the basis of potential noncompliance with regulations regarding select agents and toxins.  As 
part of our analysis, we noted the regulation sections that DSAT cited as reasons for 
observations.  We also determined the number and average number of observations that resulted 
from announced and unannounced inspections. 
 
Number of TLR Events That Were Reported to DSAT and the Risk Categories and 
Levels Associated With These Events   
We analyzed spreadsheets from the NSAR database to calculate the number, median, average, 
and percentage of TLR events from 2013 through 2015.  As part of this analysis, we determined 
whether DSAT classified each event as a Theft, Loss, Release, or Incident.  We also determined 
the occupational risk categories that DSAT assigned to each event (e.g., Minimal/No Exposure, 
Potential Exposure) and determined the number of TLR events associated with each occupational 
risk category. 
19 
   
 
Number of Compliance Actions That DSAT Initiated 
We analyzed spreadsheets from the NSAR database to calculate the number and percentage of 
compliance actions (e.g., Referrals, Corrective Action Plans) that DSAT initiated from 2013 
through 2015.  We also collected and analyzed policies that described how DSAT determines 
whether to initiate a compliance action, as well as documentation of all initiated compliance 
actions from DSAT so we could determine the reasons for these actions.  Finally, we determined 
the status of Referrals to AgSAS, FBI, and HHS OIG.   
 
Limitations  
This data brief is based on analysis of DSAT data; we did not independently validate the 
accuracy or completeness of the data that we analyzed.  Any errors or omissions, such as 
incorrect numbers of inspections performed by DSAT, may affect our results.26 
 
Standards  
This study was conducted in accordance with the Quality Standards for Inspection and 
Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
20 
  APPENDIX C 
 
 
Exhibit C-1: Number and Percentage of Inspections Per Year By Inspection Type, 20132015 
Number of Inspections  Percentage of 
Total Number 
Inspection Type  Inspections 
of Inspections* 
20132015 
2013  2014  2015 
Registration Renewal  92  103  78  273  55% 
Verification   29  48  53  130  26% 
New Space  7  7  12  26  5% 
Compliance   6  7  12  25  5% 
Maximum Containment  7  8  5  20  4% 
Reinspection  12  0  2  14  3% 
New Entity   6  3  1  10  2% 
Investigation  0  0  2  2  <0.5% 
Total  159  176  165  500  100% 
Source:  HHS OIG analysis of DSAT data, 2016. 
*Note: In some cases, DSAT inspected the same entities multiple times. 
 
 
 
Exhibit C-2: Average Number of Observations Identified From Announced and Unannounced Inspections By Inspection 
Type, 20132015 
Average Number of Observations 
Per Inspection 
Inspection Type 
Announced  Unannounced 
Registration Renewal  17  27 
Verification  17  12 
Compliance  4  12 
Reinspection  12  n/a 
Investigation  9  n/a 
Maximum Containment  10  n/a 
New Space  17  n/a 
New Entity  33  n/a 
Total  17  14 
        
Source:  HHS OIG analysis of DSAT data, 2016. 
 
 
 
 
 
 
21 
  Exhibit C-3: Type, Number, and Percentage of TLR Events By Year, 20132015  
Number of TLR Events  Percentage of TLR 
Total Number of 
TLR Event  Events 
TLR Events 
2013  2014  2015  20132015  
Release  97  81  109  287  84% 
Loss  17  9  11  37  11% 
Incident  0  7  10  17  5% 
Theft  0  0  0  0  0% 
Total  114  97  130  341  100% 
Source: HHS OIG analysis of DSAT data, 2016. 
 
 
 
 
 
 
Exhibit C-4:  Type, Number, and Percentage of Compliance Actions Per Year by Type of Compliance Action, 2013
2015  
Number of Compliance Actions  Total Number of  Percentage of 
Compliance  Compliance 
Type of Compliance Action 
Actions   Actions 
2013  2014  2015  20132015  20132015 
Referral  15  12  23  50  71% 
   To AgSAS  5  5  15  25  36%* 
   To FBI   9  5  5  19  27%* 
    To HHS OIG   1  2  3  6  9%* 
Corrective Action Plan  2  9  5  16  23% 
Registration Suspension  1  0  3  4  6% 
Application Registration Denial  0  0  0  0  0% 
Registration Revocation  0  0  0  0  0% 
Total  18  21  31  70  100% 
Source:  HHS OIG analysis of DSAT data, 2016. 
*Note: The sum of the percentages of the Referral types exceeds the total percentage of Referrals because of rounding. 
   
 
 
 
 
22 
  APPENDIX D 
Exhibit D-1: Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and Associated 
Subsections Identified From 2013 Through 2015  
Number of Times 
Regulatory 
Identified in 
Section 
Brief Description  DSAT 
and 
Inspections,  
Subsection 
20132015 
42 CFR 
Biosafety   2554 
 73.12 
42 CFR 
-- Unclassified 27  1857 
 73.12 
-- An individual or entity required to register under this part must develop and implement a written 
biosafety plan that is commensurate with the risk of the select agent or toxin, given its intended 
use. The biosafety plan must contain sufficient information and documentation to describe the 
--Section 12(a)  300 
biosafety and containment procedures for the select agent or toxin, including any animals 
(including arthropods) or plants intentionally or accidentally exposed to or infected with a select 
agent 
-- Section  -- The biosafety and containment procedures must be sufficient to contain the select agent or toxin 
178 
12(b)  (e.g., physical structure and features of the entity, and operational and procedural safeguards) 
-- The biosafety plan must include an occupational health program for individuals with access to 
-  Section 
Tier 1 select agents and toxins, and those individuals must be enrolled in the occupational health  119 
12(d) 
program 
-- The plan must be reviewed annually and revised as necessary. Drills or exercises must be 
-- Section 
conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be  96 
12(e) 
reviewed and revised, as necessary, after any drill or exercise and after any incident 
-- In developing a biosafety plan, an individual or entity should consider: The NIH Guidelines for 
-- Section 
Research Involving Recombinant DNA Molecules, (NIH Guidelines). This document is available  3 
12(c)(3) 
on the National Select Agent Registry Web site at http://www.selectagents.gov  
-- In developing a biosafety plan, an individual or entity should consider: The CDC/NIH publication, 
-- Section 
Biosafety in Microbiological and Biomedical Laboratories. This document is available on the  1 
12(c)(1) 
National Select Agent Registry Web site at http://www.selectagents.gov  
42 CFR  
Security  2369 
73.11 
-- Subsection  -- Procedures for informing Responsible Official and other appropriate agencies of suspected 
268 
(c)(8)  criminal activity 
continued on next page 
   
23 
  Exhibit D-1 (Continued): Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Number of Times 
Regulatory 
Identified in DSAT 
Section and  Brief Description  Inspections, 
Subsection 
20132015 
-- Provisions, policies, and procedures for shipping, receiving,  monitoring,  and storage of 
-- Subsection 
 all select agents and toxins to include properly secured containers and contingency plans   198 
(c)(10) 
for unexpected shipments 
-- Ensure that authorized and authenticated users are only granted access to select agent 
and toxin related information, files, equipment (e.g., servers or mass storage devices) and 
-- Section 
applications as necessary to fulfill their roles and responsibilities, and that access is modified  164 
11(c)(9)(ii) 
when the user's roles and responsibilities change or when their access to select agents and 
toxins is suspended or revoked 
-- Contain provisions for the control of access to select agents and toxins including the 
safeguarding of animals (including arthropods) or plants intentionally or accidentally 
-- Section 11(c)(2)  125 
exposed to or infected with a select agent, against unauthorized access, theft, loss or 
release 
-- Section  -- Establish a robust configuration management practice for information systems to include 
119 
11(c)(9)(iv)  regular patching and updates made to operating systems and individual applications 
-- Establish procedures that provide backup security measures in the event that access 
-- Section 
control systems, surveillance devices, and/or systems that manage the requirements of  119 
11(c)(9)(v) 
section 17 of this part are rendered inoperable 
-- An individual or entity required to register under this part must develop and implement a 
-- Section 11(a)  written security plan. The security plan must be sufficient to safeguard the select agent or  97 
toxin against unauthorized access, theft, loss, or release 
-- Ensure that controls are in place that are designed to prevent malicious code (such as, 
-- Section  but not limited to, computer virus, worms, spyware) from compromising the confidentiality, 
95 
11(c)(9)(iii)  integrity, or availability of information systems which manage access to spaces registered 
under this part or records in 73.17 
--  Describe  procedures  for  addressing  loss  or  compromise  of  keys,  passwords, 
-- Section 11(c)(5)  combinations, etc. and protocols for changing access numbers or locks following staff  89 
changes 
-- Describe procedures for physical security, inventory control, and information systems 
-- Section 11(c)(1)  81 
control 
-- The plan must be reviewed annually and revised as necessary. Drills or exercises must 
-- Section 11(h)  be conducted at least annually to test and evaluate the effectiveness of the plan. The plan  81 
must be reviewed and revised, as necessary, after any drill or exercise and after any incident 
-- Procedures that will limit access to a Tier 1 select agent or toxin to only those individuals 
-- Section  who are approved by the HHS Secretary or Administrator, following a security risk 
67 
11(f)(4)(iii)  assessment by the Attorney General, have had an entity-conducted pre-access suitability 
assessment, and are subject to the entity's procedures for ongoing suitability assessment 
continued on next page 
24 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section   Identified in DSAT 
Brief Description 
and  Inspections,  
Subsection  20132015 
-- A minimum of three security barriers where each security barrier adds to the delay in reaching 
secured areas where select agents and toxins are used or stored. One of the security barriers 
-- Section  must be monitored in such a way as to detect intentional and unintentional circumventing of 
60 
11(f)(4)(iv)  established access control measures under all conditions (day/night, severe weather, etc.) The 
final barrier must limit access to the select agent or toxin to personnel approved by the HHS 
Secretary or Administrator, following a security risk assessment by the Attorney General 
-- Section  -- Ensure that all external connections to systems which manage security for the registered 
52 
11(c)(9)(i)  space are isolated or have controls that permit only authorized and authenticated users 
-- Describe procedures for how an entity's Responsible Official will coordinate their efforts with 
-- Section 
the entity's safety and security professionals to ensure security of Tier 1 select agents and toxins  49 
11(f)(2) 
and share, as appropriate, relevant information 
-- The entity must determine that the response time for security forces or local police will not 
-- Section 
exceed 15 minutes where the response time is measured from the time of an intrusion alarm, or  49 
11(f)(4)(viii)(A) 
report of a security incident, to the arrival of the responders at the first security barrier 
-- Section 
-- Allow access only to individuals with access approval from the HHS Secretary or Administrator  46 
11(d)(1) 
-- Section  -- Contain procedures for reporting unauthorized or suspicious persons or activities, loss or theft 
43 
11(c)(6)  of select agents or toxins, release of select agents or toxins, or alteration of inventory records 
-- Describe procedures for the ongoing assessment of the suitability of personnel with access to 
-- Section 
a Tier 1 select agent or toxin. The procedures must include the ongoing suitability monitoring of  43 
11(f)(3)(iii) 
individuals with access to Tier 1 select agents and toxins 
-- Entities with Tier 1 select agents and toxins must prescribe procedures that limit access to 
-- Section 
laboratory and storage facilities outside of normal business hours to only those specifically  43 
11(f)(4)(ii) 
approved by the Responsible Official or designee 
--  Entities  with  Tier  1  select  agents  and  toxins  must  prescribe  the  following  security 
-- Section 
enhancements: All registered space or areas that reasonably afford access to the registered  41 
11(f)(4)(v) 
space must be protected by an intrusion detection system (IDS) unless physically occupied 
-- Describe procedures for the ongoing assessment of the suitability of personnel with access to 
-- Section  a Tier 1 select agent or toxin. The procedures must include self- and peer-reporting of incidents 
40 
11(f)(3)(i)  or conditions that could affect an individual's ability to safely have access to or work with select 
agents and toxins, or to safeguard select agents and toxins from theft, loss, or release 
-- Describe procedures for the ongoing assessment of the suitability of personnel with access to 
-- Section  a Tier 1 select agent or toxin. The procedures must include the training of employees with access 
40 
11(f)(3)(ii)  to Tier 1 select agents and toxins on entity policies and procedures for reporting, evaluation, and 
corrective actions concerning the assessment of personnel suitability 
continued on next page 
25 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- The security plan must be designed according to a site-specific risk assessment and must 
-- Section  provide graded protection in accordance with the risk of the select agent or toxin, given its 
38 
11(b)  intended use. A current security plan must be submitted for initial registration, renewal of 
registration, or when requested 
--  Entities  with  Tier  1  select  agents  and  toxins  must  prescribe  the  following  security 
enhancements: Procedures that will limit access to a Tier 1 select agent or toxin to only those 
-- Section 
individuals who are approved by the HHS Secretary or Administrator, following a security risk  36 
11(f)(4)(i) 
assessment by the Attorney General, have had an entity-conducted pre-access suitability 
assessment, and are subject to the entity's procedures for ongoing suitability assessment 
-- In addition to the requirements contained in paragraphs (c) and (d) of this section, the security 
-- Section  plan for an individual or entity possessing a Tier 1 select agent or toxin must also: Describe 
34 
11(f)(1)  procedures for conducting a pre-access suitability assessment of persons who will have access 
to a Tier 1 select agent or toxin. 
--  Entities  with  Tier  1  select  agents  and  toxins  must  prescribe  the  following  security 
-- Section  enhancements: For powered access control systems, describe procedures to ensure that 
33 
11(f)(4)(vii)  security is maintained in the event of the failure of access control systems due to power disruption 
affecting registered space 
-- Section 
-- The security plan must: Establish procedures for removing unauthorized or suspicious persons  29 
11(c)(4) 
--  Entities  with  Tier  1  select  agents  and  toxins  must  prescribe  the  following  security 
-- Section 
enhancements: Personnel monitoring the IDS must be capable of evaluating and interpreting the  29 
11(f)(4)(vi) 
alarm and alerting the designated security response force or law enforcement 
-- Require that individuals with access approval from the HHS Secretary or Administrator refrain 
-- Section 
from sharing with any other person their unique means of accessing a select agent or toxin (e.g.,  18 
11(d)(6) 
keycards or passwords) 
-- An individual or entity must adhere to the following security requirements or implement 
measures to achieve an equivalent or greater level of security: Provide for the control of select 
-- Section 
agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select  17 
11(d)(3) 
agents or toxins are stored to be secured against unauthorized access (e.g., card access system, 
lock boxes) 
-- Entities must conduct complete inventory audits of all affected select agents and toxins in long-
-- Section 
term storage when any of the following occur: Upon the physical relocation of a collection or  17 
11(e)(1) 
inventory of select agents or toxins for those select agents or toxins in the collection or inventory 
-- Entities must conduct complete inventory audits of all affected select agents and toxins in long-
-- Section 
term storage when any of the following occur: Upon the departure or arrival of a principal  16 
11(e)(2) 
investigator for those select agents and toxins under the control of that principal investigator 
continued on next page 
26 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- An individual or entity must adhere to the following security requirements or implement 
measures to achieve an equivalent or greater level of security: Establish a protocol for intra-
-- Section 
entity transfers under the supervision of an individual with access approval from the HHS  15 
11(d)(5) 
Secretary  or  Administrator,  including  chain-of-custody  documents  and  provisions  for 
safeguarding against theft, loss, or release 
  -- The security plan must: Contain provisions for ensuring that all individuals with access 
-- Section  approval from the HHS Secretary or Administrator understand and comply with the security  13 
11(c)(7)  procedures 
-- The entity must: Provide security barriers that are sufficient to delay unauthorized access until 
the response force arrives in order to safeguard the select agents and toxins from theft, 
-- Section 
intentional release, or unauthorized access. The response time is measured from the time of  13 
11(f)(4)(viii)(B) 
an intrusion alarm, or report of a security incident, to the arrival of the responders at the first 
security barrier 
-- Require that individuals with access approval from the HHS Secretary or Administrator 
-- Section 
immediately report any of the following to the Responsible Official: Any loss or compromise of  11 
11(d)(7)(i) 
keys, passwords, combination, etc. 
-- Section 
-- The security plan must: Contain provisions for routine cleaning, maintenance, and repairs  9 
11(c)(3) 
-- An individual or entity must adhere to the following security requirements or implement 
measures to achieve an equivalent or greater level of security: Allow individuals not approved 
-- Section 
for access from the HHS Secretary or Administrator to conduct routine cleaning, maintenance,  6 
11(d)(2) 
repairs, or other activities not related to select agents or toxins only when continuously escorted 
by an approved individual if the potential for access to select agents or toxins exists 
-- In developing a security plan, an individual or entity should consider the document entitled, 
-- Section 11(g)  Security Guidance for Select Agent or Toxin Facilities. This document is available on the  6 
National Select Agent Registry at http://www.selectagents.gov/  
--  An individual or entity must adhere to the following security requirements or implement 
-- Section  measures to achieve an equivalent or greater level of security: Inspect all suspicious packages 
5 
11(d)(4)  before they are brought into or removed from the area where select agents or toxins are used 
or stored 
-- An individual or entity must adhere to the following security requirements or implement 
measures to achieve an equivalent or greater level of security: Require that individuals with 
-- Section 
access approval from the HHS Secretary or Administrator immediately report any of the  4 
11(d)(7)(v) 
following to the Responsible Official: Any sign that inventory or use records for select agents or 
toxins have been altered or otherwise compromised 
-- Entities must conduct complete inventory audits of all affected select agents and toxins in 
-- Section 
long-term storage when any of the following occur: In the event of a theft or loss of a select  4 
11(e)(3) 
agent or toxin, all select agents and toxins under the control of that principal investigator 
continued on next page 
 
27 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- An individual or entity must adhere to the following security requirements or implement 
-- Section  measures to achieve an equivalent or greater level of security: Require that individuals with 
3 
11(d)(7)(ii)  access approval from the HHS Secretary or Administrator immediately report any of the 
following to the Responsible Official: Any suspicious persons or activities 
-- An individual or entity must adhere to the following security requirements or implement 
-- Section  measures to achieve an equivalent or greater level of security: Require that individuals with 
3 
11(d)(7)(iv)  access approval from the HHS Secretary or Administrator immediately report any of the 
following to the Responsible Official: Any release of a select agent or toxin 
-- An individual or entity must adhere to the following security requirements or implement 
-- Section  measures to achieve an equivalent or greater level of security: Require that individuals with 
1 
11(d)(7)(iii)  access approval from the HHS Secretary or Administrator immediately report any of the 
following to the Responsible Official: Any loss or theft of select agents or toxins 
42 CFR 
Incident Response  1044 
 73.14 
-- The incident response plan must fully describe the entity's response procedures for the theft, 
loss, or release of a select agent or toxin; inventory discrepancies; security breaches (including 
-- Section 14(b)  information systems); severe weather and other natural disasters; workplace violence; bomb  173 
threats and suspicious packages; and emergencies such as fire, gas leak, explosion, power 
outage, and other natural and man-made events 
-- The response procedures must account for hazards associated with the select agent or toxin 
-- Section 14(c)  and appropriate actions to contain such select agent or toxin, including any animals (including  120 
arthropods) or plants intentionally or accidentally exposed to or infected with a select agent 
-- Entities with Tier 1 select agents and toxins must have the following additional incident 
-- Section 
response policies or procedures: The incident response plan must fully describe the entity's  96 
14(e)(1) 
response procedures for failure of intrusion detection or alarm system 
-- Entities with Tier 1 select agents and toxins must have the following additional incident 
response policies or procedures: The incident response plan must describe procedures for how 
-- Section 
the entity will notify the appropriate Federal, State, or local law enforcement agencies of  88 
14(e)(2) 
suspicious activity that may be criminal in nature and related to the entity, its personnel, or its 
select agents or toxins 
-- Section  -- The incident response plan must also contain the following information: Decontamination 
81 
14(d)(12)  procedures 
-- Section  -- The incident response plan must also contain the following information: A list of personal 
80 
14(d)(9)  protective and emergency equipment, and their locations 
-- The plan must be reviewed annually and revised as necessary. Drills or exercises must be 
-- Section 14(f)  conducted at least annually to test and evaluate the effectiveness of the plan. The plan must  68 
be reviewed and revised, as necessary, after any drill or exercise and after any incident 
continued on next page 
 
28 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- The incident response plan must also contain the following information: Procedures for 
-- Section 
emergency evacuation, including type of evacuation, exit route assignments, safe distances,  58 
14(d)(11) 
and places of refuge 
-- Section  -- The incident response plan must also contain the following information: Site security and 
57 
14(d)(10)  control 
-- An individual or entity required to register under this part must develop and implement a 
written incident response plan based upon a site specific risk assessment. The incident 
-- Section 14(a)  55 
response plan must be coordinated with any entity-wide plans, kept in the workplace, and 
available to employees for review 
-- Section  -- The incident response plan must also contain the following information: Personnel roles and 
41 
14(d)(5)  lines of authority and communication 
-- Section  -- The incident response plan must also contain the following information: Planning and 
38 
14(d)(6)  coordination with local emergency responders 
-- Section  -- The incident response plan must also contain the following information: Procedures to be 
28 
14(d)(7)  followed by employees performing rescue or medical duties 
-- Section  -- The incident response plan must also contain the following information: Emergency medical 
27 
14(d)(8)  treatment and first aid 
-- The incident response plan must also contain the following information: The name and contact 
-- Section 
information (e.g., home and work) for the individual or entity (e.g., responsible official, alternate  12 
14(d)(1) 
responsible official(s), biosafety officer, etc.) 
-- Section  -- The incident response plan must also contain the following information: The name and contact 
10 
14(d)(4)  information for the physical security official for the building, where applicable 
-- Section  -- The incident response plan must also contain the following information: The name and contact 
8 
14(d)(2)  information for the building owner and/or manager, where applicable 
-- Section  -- The incident response plan must also contain the following information: The name and contact 
3 
14(d)(3)  information for tenant offices, where applicable 
-- The response procedures must account for hazards associated with the select agent or toxin 
-- Section 
and appropriate actions to contain such select agent or toxin, including any animals (including  1 
14(c)(9) 
arthropods) or plants intentionally or accidentally exposed to or infected with a select agent 
42 CFR 
Records  1026 
 73.17 
-- An individual or entity required to register under this part must maintain complete records 
-- Section  relating to the activities covered by this part. Such records must include: Information about all 
162 
17(a)(5)  entries into areas containing select agents or toxins, including the name of the individual, name 
of the escort (if applicable), and date and time of entry 
continued on next page 
29 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- Such records must include: An accurate, current inventory for each select agent (including 
-- Section  viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
100 
17(a)(1)  recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system 
designed to ensure viability for future use, such as in a freezer or lyophilized materials) 
-- An individual or entity required to register under this part must maintain complete records 
--  Section 
relating to the activities covered by this part. Such records must include: A written explanation  88 
17(a)(7) 
of any discrepancies 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section  recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system 
86 
17(a)(1)(ii)  designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: The quantity acquired from another individual or entity (e.g., containers, vials, tubes, 
etc.), date of acquisition, and the source 
-- The individual or entity must implement a system to ensure that all records and data bases 
-- Section 17(b)  created under this part are accurate, have controlled access, and that their authenticity may be  85 
verified 
-- All records created under this part must be maintained for three years and promptly produced 
-- Section 17(c)  57 
upon request 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section 
recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system  56 
17(a)(1)(iv) 
designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: When moved from storage and by whom and when returned to storage and by whom 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section 
recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system  55 
17(a)(1)(v) 
designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: The select agent used and purpose of use 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section  recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system 
49 
17(a)(1)(i)  designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: The name and characteristics (e.g., strain designation, GenBank Accession number, 
etc.) 
-- An individual or entity required to register under this part must maintain complete records 
-- Section  relating to the activities covered by this part. Such records must include: An accurate, current 
48 
17(a)(2)  accounting of any animals or plants intentionally or accidentally exposed to or infected with a 
select agent (including number and species, location, and appropriate disposition) 
continued on next page 
30 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section 
recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system  43 
17(a)(1)(iii) 
designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: Where stored (e.g., building, room, and freezer) 
-- Section  -- Such records must include: A current list of all individuals that have been granted access 
27 
17(a)(4)  approval from the HHS Secretary or Administrator 
-- Section  -- Such records must include: Accurate, current inventory for each toxin held, including: The 
24 
17(a)(3)(iii)  initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.) 
-- Section 
-- Such records must include: Accurate, current inventory for each toxin held  21 
17(a)(3) 
-- Such records must include: Accurate, current inventory for each toxin held, including: When 
-- Section 
moved from storage and by whom and when returned to storage and by whom including quantity  19 
17(a)(3)(vi) 
amount 
-- Such records must include: Accurate, current records created under 73.9 and 9 CFR part 
-- Section  121.9 (Responsible Official), 73.11 and 9 CFR part 121.11 (Security), 73.12 and 9 CFR part 
19 
17(a)(6)  121.12 (Biosafety), 73.14 and 9 CFR part 121. 14 (Incident response), and 73.15 and 9 CFR 
part 121.15 (Training) 
-- Such records must include: Accurate, current inventory for each toxin held, including: The 
-- Section 
quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of  18 
17(a)(3)(ii) 
acquisition, and the source 
-- Section  -- Such records must include: Accurate, current inventory for each toxin held, including: Where 
16 
17(a)(3)(v)  stored (e.g., building, room, and freezer) 
-- Section  --Such records must include: If destroyed, the quantity of toxin destroyed, the date of such 
16 
17(a)(3)(x)  action, and by whom 
-- Section  -- Such records must include: Accurate, current inventory for each toxin held, including: The 
13 
17(a)(3)(iv)  toxin used and purpose of use, quantity, date(s) of the use and by whom 
-- Section  -- Such records must include: Accurate, current inventory for each toxin held, including: The 
9 
17(a)(3)(i)  name and characteristics 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system 
- Section 
designed to ensure viability for future use, such as in a freezer or lyophilized materials),  6 
17(a)(1)(vii) 
including: For intra-entity transfers (sender and the recipient are covered by the same certificate 
of registration), the select agent, the quantity transferred, the date of transfer, the sender, and 
the recipient 
continued on next page 
 
31 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section 
recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system  4 
17(a)(1)(vi) 
designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: Records created under 73.16 and 9 CFR 121.16 (Transfers) 
-- Such records must include: Accurate, current inventory for each toxin held, including: For 
-- Section  intra-entity transfers (sender and the recipient are covered by the same certificate of 
3 
17(a)(3)(viii)  registration), the toxin, the quantity transferred, the date of transfer, the sender, and the 
recipient 
-- Such records must include: An accurate, current inventory for each select agent (including 
viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing 
-- Section  recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system 
1 
17(a)(1)(viii)  designed to ensure viability for future use, such as in a freezer or lyophilized materials), 
including: Records created under 73.19 and 9 CFR part 121.19 (Notification of theft, loss, or 
release) 
-- Section  -- Such records must include: Accurate, current inventory for each toxin held, including: Records 
1 
17(a)(3)(vii)  created under 73.16 and 9 CFR part 121.16 (Transfers) 
42 CFR 
Training  566 
 73.15 
-- An individual or entity required to register under this part must provide information and training 
on biosafety, security (including security awareness), and incident response to: Each individual 
not approved for access to select agents and toxins by the HHS Secretary or Administrator 
-- Section 
before that individual enters areas where select agents or toxins are handled or stored (e.g.,  212 
15(a)(2) 
laboratories, growth chambers, animal rooms, greenhouses, storage areas, shipping/receiving 
areas, production facilities, etc.). Training for escorted personnel must be based on the risk 
associated with accessing areas where select agents and toxins are used and/or stored 
-- Refresher training must be provided annually for individuals with access approval from the 
-- Section 15(c)  HHS Secretary or Administrator or at such time as the registered individual or entity significantly  137 
amends its security, incident response, or biosafety plans 
-- The Responsible Official must ensure a record of the training provided to each individual with 
access to select agents and toxins and each escorted individual (e.g., laboratory workers, 
-- Section 15(d)  visitors, etc.) is maintained. The record must include the name of the individual, the date of the  99 
training, a description of the training provided, and the means used to verify that the employee 
understood the training 
-- An individual or entity required to register under this part must provide information and training 
on biosafety, security (including security awareness), and incident response to: Each individual 
-- Section 
with access approval from the HHS Secretary or Administrator before that individual has such  71 
15(a)(1) 
access to select agents and toxins. The training must address the particular needs of the 
individual, the work they will do, and the risks posed by the select agents or toxins 
continued on next page 
32 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- Entities with Tier 1 select agents and toxins must conduct annual insider threat awareness 
-- Section 15(b)  46 
briefings on how to identify and report suspicious behaviors 
-- An individual or entity required to register under this part must provide information and training 
-- Section 15(a)  1 
on biosafety, security (including security awareness), and incident response 
42 CFR  73.9  Responsible Official  243 
-- An individual or entity required to register under this part must designate an individual to be 
the Responsible Official. The Responsible Official must: Ensure that annual inspections are 
--  Section 
conducted for each laboratory where select agents or toxins are stored or used in order to  114 
9(a)(6) 
determine compliance with the requirements of this part. The results of each inspection must 
be documented, and any deficiencies identified during an inspection must be corrected 
-- An individual or entity required to register under this part must designate an individual to be 
-- Section 
the  Responsible  Official.  The  Responsible  Official  must:  Ensure  compliance  with  the  69 
9(a)(4) 
requirements of this part 
-- An individual or entity required to register under this part must designate an individual to be 
-- Section 
the Responsible Official. The Responsible Official must: Be familiar with the requirements of  17 
9(a)(2) 
this part 
-- An individual or entity required to register under this part must designate an individual to be 
the Responsible Official. The Responsible Official must: Have a physical (and not merely a 
--  Section  telephonic or audio/visual) presence at the registered entity to ensure that the entity is in 
12 
9(a)(5)  compliance with the select agent regulations and be able to respond in a timely manner to onsite 
incidents involving select agents and toxins in accordance with the entity's incident response 
plan 
-- An entity may designate one or more individuals to serve as an alternate Responsible Official, 
who acts for the Responsible Official in his/her absence. These individuals must have the 
-- Section 9(b)  10 
authority and control to ensure compliance with the regulations when acting as the Responsible 
Official 
-- The Responsible Official must report the identification and final disposition of any select agent 
or toxin contained in a specimen presented for diagnosis or verification. To report the 
-- Section 
identification and final disposition of any other select agent or toxin, APHIS/CDC Form 4 must  10 
9(c)(2) 
be submitted within seven calendar days after identification. A copy of the completed form must 
be maintained for three years 
-- An individual or entity required to register under this part must designate an individual to be 
--  Section 
the Responsible Official. The Responsible Official must: Have authority and responsibility to act  5 
9(a)(3) 
on behalf of the entity 
continued on next page 
 
33 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
--The Responsible Official must report the identification and final disposition of any select agent 
or toxin contained in a specimen presented for diagnosis or verification 
The identification of any of the following select agents or toxins must be immediately reported 
-- Section  by telephone, facsimile, or e-mail: Bacillus anthracis, Botulinum neurotoxins, Botulinum 
9(c)(1)  neurotoxin producing species of Clostridium, Burkholderia mallei, Burkholderia pseudomallei  3 
Francisella tularensis, Ebola viruses, Marburg virus, Variola major virus (Smallpox virus), 
Variola minor (Alastrim), or Yersinia pestis. The final disposition of the agent or toxin must be 
reported by submission of APHIS/CDC Form 4 within seven calendar days after identification. 
A copy of the completed form must be maintained for three years 
-- The Responsible Official must report the identification and final disposition of any select agent 
or toxin contained in a specimen presented for proficiency testing. To report the identification 
-- Section 9(d)  and final disposition of a select agent or toxin, APHIS/CDC Form 4 must be submitted within 90  2 
calendar days of receipt of the agent or toxin. A copy of the completed form must be maintained 
for three years 
-- An individual or entity required to register under this part must designate an individual to be 
-- Section 
the Responsible Official. The Responsible Official must: Be approved by the HHS Secretary or  1 
9(a)(1) 
Administrator following a security risk assessment by the Attorney General 
42 CFR  73.7  Registration and Related Security Assessments  192 
-- A certificate of registration may be amended to reflect changes in circumstances (e.g., 
replacement of the Responsible Official or other personnel changes, changes in ownership or 
-- Section  control of the entity, changes in the activities involving any select agents or toxins, or the 
131 
7(h)(1)  addition or removal of select agents or toxins).  Prior to any change, the Responsible Official 
must apply for an amendment to a certificate of registration by submitting the relevant page(s) 
of the registration application 
-- A certificate of registration may be amended to reflect changes in circumstances (e.g., 
-- Section  replacement of the Responsible Official or other personnel changes, changes in ownership or 
20 
7(h)(3)  control of the entity, changes in the activities involving any select agents or toxins, or the 
addition or removal of select agents or toxins).  No change may be made without such approval 
-- A certificate of registration may be amended to reflect changes in circumstances (e.g., 
replacement of the Responsible Official or other personnel changes, changes in ownership or 
control of the entity, changes in the activities involving any select agents or toxins, or the 
-- Section  addition or removal of select agents or toxins).  The Responsible Official will be notified in writing 
19 
7(h)(2)  if an application to amend a certificate of registration has been approved. Approval of the 
amendment may be contingent upon an inspection or submission of additional information, such 
as the security plan, biosafety plan, incident response plan, or any other documents required to 
be prepared under this part 
-- Unless exempted under 73.5, an individual or entity shall not possess, use, or transfer any 
HHS select agent or toxin without a certificate of registration issued by the HHS Secretary. 
-- Section 7(a)  Unless exempted under 73.6 or 9 CFR part 121.6, an individual or entity shall not possess,  10 
use, or transfer overlap select agents or toxins, without a certificate of registration issued by the 
HHS Secretary and Administrator 
continued on next page 
34 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- A certificate of registration will be valid for one physical location (a room, a building, or a group 
-- Section 7(g)  of buildings) where the Responsible Official will be able to perform the responsibilities required  8 
in this part, for specific select agents or toxins, and for specific activities 
-- An entity must immediately notify CDC or APHIS if it loses the services of its Responsible 
Official. In the event that an entity loses the services of its Responsible Official, an entity may 
-- Section 7(i)  continue to possess or use select agents or toxins only if it appoints as the Responsible Official  2 
another individual who has been approved by the HHS Secretary or Administrator following a 
security risk assessment by the Attorney General and who meets the requirements of this part 
-- An individual will be deemed to own or control an entity under the following conditions:1   For 
a private institution of higher education, an individual will be deemed to own or control the entity 
-- Section 
if the individual is in a managerial or executive capacity with regard to the entity's select agents  1 
7(c)(3)(i) 
or toxins or with regard to the individuals with access to the select agents or toxins possessed, 
used, or transferred by the entity 
-- Prior to the issuance of a certificate of registration, the Responsible Official must promptly 
-- Section 7(e)  provide notification of any changes to the application for registration by submitting the relevant  1 
page(s) of the registration application 
42 CFR 
Transfers  58 
 73.16 
-- Except as provided in paragraphs (c) and (d) of this section, a select agent or toxin may only 
be transferred to individuals or entities registered to possess, use, or transfer that agent or toxin. 
A select agent or toxin may only be transferred under the conditions of this section and must 
-- Section 16(a)  be authorized by CDC or APHIS prior to the transfer4  19 
4This section does not cover transfers within an entity when the sender and the recipient are 
covered by the same certificate of registration 
-- A registered individual or entity transferring an amount of a HHS toxin otherwise excluded 
under the provisions of 73.3(d) must: Transfer the amounts only after the transferor uses due 
-- Section 
diligence and documents that the recipient has a legitimate need (i.e., reasonably justified by a  14 
16(l)(i) 
prophylactic, protective, bona fide research, or other peaceful purpose) to handle or use such 
toxins 
-- Section 16(e)  -- To obtain authorization for transfer, APHIS/CDC Form 2 must be submitted  6 
-- A registered individual or entity transferring an amount of a HHS toxin otherwise excluded 
-- Section  under the provisions of 73.3(d) must: (2) Report to CDC if they detect a known or suspected 
6 
16(l)(ii)  violation of Federal law or become aware of suspicious activity related to a toxin listed in 
73.3(d) of this part 
--After authorization is provided by APHIS or CDC, the packaging of the select agent(s) and 
toxin(s) is performed by an individual approved by the HHS Secretary or Administrator to have 
-- Section 16(f)  4 
access to select agents and toxins and is in compliance with all applicable laws concerning 
packaging 
continued on next page 
35 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- The recipient must submit a completed APHIS/CDC Form 2 within two business days of 
-- Section 16(i)  4 
receipt of a select agent or toxin 
-- Transportation in commerce starts when the select agent(s) or toxin(s) are packaged for 
shipment and ready for receipt by a courier transporting select agent(s) or toxin(s) and ends 
-- Section 16(h)  when the package is received by the intended recipient who is an individual approved by the  3 
HHS Secretary or Administrator to have access to select agents and toxins, following a security 
risk assessment by the Attorney General 
-- A transfer may be authorized if: The sender: Has at the time of transfer a certificate of 
-- Section 
registration that covers the particular select agent or toxin to be transferred and meets all  2 
16(b)(1)(i) 
requirements in this part 
42 CFR 
Notification of Theft, Loss, or Release  28 
 73.19 
-- Upon discovery of the theft or loss of a select agent or toxin, an individual or entity must 
immediately notify CDC or APHIS and appropriate Federal, State, or local law enforcement 
-- Section 19(a)  14 
agencies. Thefts or losses must be reported even if the select agent or toxin is subsequently 
recovered or the responsible parties are identified 
-- Upon discovery of a release of an agent or toxin causing occupational exposure or release of 
-- Section 19(b)  a select agent or toxin outside of the primary barriers of the biocontainment area, an individual  9 
or entity must immediately notify CDC or APHIS 
-- Upon discovery of the theft or loss of a select agent or toxin, an individual or entity must 
immediately notify CDC or APHIS and appropriate Federal, State, or local law enforcement 
-- Section 
agencies. Thefts or losses must be reported even if the select agent or toxin is subsequently  2 
19(a)(2) 
recovered or the responsible parties are identified.  A completed APHIS/CDC Form 3 must 
submitted within seven calendar days 
-- Upon discovery of a release of an agent or toxin causing occupational exposure or release of 
-- Section  a select agent or toxin outside of the primary barriers of the biocontainment area, an individual 
2 
19(b)(2)  or entity must immediately notify CDC or APHIS.  A completed APHIS/CDC Form 3 must be 
submitted within seven calendar days 
-- Upon discovery of the theft or loss of a select agent or toxin, an individual or entity must 
immediately notify CDC or APHIS and appropriate Federal, State, or local law enforcement 
agencies. Thefts or losses must be reported even if the select agent or toxin is subsequently 
-- Section 
recovered or the responsible parties are identified.  The theft or loss of a select agent or toxin  1 
19(a)(1)(i) 
must be reported immediately by telephone, facsimile, or e-mail. The following information must 
be provided: The name of the select agent or toxin and any identifying information (e.g., strain 
or other characterization information) 
42 CFR 
Restricting Access to Select Agents and Toxins; Security Risk Assessments  27 
 73.10 
-- The Responsible Official must immediately notify CDC or APHIS when an individual's access 
-- Section 10(k)  13 
to select agents or toxins is terminated by the entity and the reasons therefore 
continued on next page 
36 
  Exhibit D-1 (Continued):  Number of Observations for Each of the 13 Regulatory Sections That DSAT Reviews and 
Associated Subsections Identified From 2013 Through 2015 
Regulatory  Number of Times 
Section  Identified in DSAT 
Brief Description 
and  Inspections, 
Subsection  20132015 
-- An individual or entity required to register under this part may not provide an individual access 
to a select agent or toxin, and an individual may not access a select agent or toxin, unless the 
-- Section 10(a)  10 
individual is approved by the HHS Secretary or Administrator, following a security risk 
assessment by the Attorney General 
-- Section 10(j)  -- Access approval is valid for a maximum of three years  3 
-- An individual will be deemed to have access at any point in time if the individual has 
-- Section 10(b)  possession of a select agent or toxin (e.g., ability to carry, use, or manipulate) or the ability to  1 
gain possession of a select agent or toxin 
42 CFR 
Restricted Experiments  4 
 73.13 
-- An individual or entity may not conduct, or possess products resulting from, the following 
-- Section 13(a)  experiments unless approved by and conducted in accordance with the conditions prescribed  3 
by the HHS Secretary 
-- An individual or entity may not conduct, or possess products resulting from, the following 
experiments unless approved by and conducted in accordance with the conditions prescribed 
-- Section 
by the HHS Secretary: Experiments involving the deliberate formation of synthetic or  1 
13(b)(2) 
recombinant DNA containing genes for the biosynthesis of select toxins lethal for vertebrates at 
an LD[50] <100 
42 CFR  73.8  Denial, Revocation, or Suspension of Registration  0 
42 CFR 
Inspections  0 
 73.18 
Source:  HHS OIG analysis of DSAT data, 2016. 
37 
  ACKNOWLEDGMENTS 
 
This report was prepared under the direction of Dwayne Grant, Regional Inspector General for 
Evaluation and Inspections in the Atlanta regional office and Jaime Stewart, Deputy Regional 
Inspector General.  
 
Victoria Coxon served as lead analyst for this study.  Office of Evaluation and Inspections staff 
who provided support include Kevin Farber, Althea Hosein, Christine Moritz, and Melicia Seay. 
 
 
 
 
     
   
  38 
                                                              
ENDNOTES    
1 CDC. 2015 Annual Report of the Federal Select Agent Program.  Accessed at 
http://www.selectagents.gov/resources/FSAP_Annual_Report_2015.pdf on June 23, 2016.  An erratum to this report 
was issued November 18, 2016, and is available at 
https://www.selectagents.gov/resources/FSAP_Annual_Report_2015_ERRATUM.pdf. 
 
2 42 CFR  73.9(a)(4). CDC/DSAT and APHIS/AgSAS. Responsible Official Resource Manual.  Accessed at 
https://www.selectagents.gov/resources/RO_Manual_2014.pdf on March 15, 2017. 
 
3 DSAT is housed within CDCs Office of Public Health Preparedness and Response (OPHPR).  OPHPR, DSAT, 
Division of Select Agents and Toxins: About the Federal Select Agent Program.  Accessed at 
https://www.cdc.gov/phpr/dsat/about-fsap.htm on February 2, 2017.   
 
4 CDC, Justification of Estimates for Appropriations Committees.  Accessed at 
https://www.cdc.gov/budget/documents/fy2017/fy-2017-cdc-congressional-justification.pdf on November 10, 2016. 
 
5 42 CFR  73.7(a). 
 
6 Regulations at 42 CFR pt. 73 implement the provisions of the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002, which sets forth the requirements for possession, use, and transfer of select 
agents and toxins.  These select agents and toxins have the potential to pose a severe threat to public health and 
safety and are subject to regulation by both CDC and APHIS.  Entities registered with the FSAP must also comply 
with regulations at 7 CFR pt. 331 and 9 CFR pt. 121.  However, regulations at 7 CFR pt. 331 apply only to plant or 
animal health or products and are not under the jurisdiction of CDC.  The regulations at 9 CFR pt. 121 are under the 
jurisdiction of both CDC and APHIS.  For the purpose of our review, we could not distinguish observations 
identified by CDC versus APHIS under this regulation.  Therefore, we did not include them in our review.      
 
7 CDC and NIH, Biosafety in Microbiological and Biomedical Laboratories, 5th edition. Accessed at 
https://www.cdc.gov/biosafety/publications/bmbl5/bmbl.pdf on January 20, 2017.  This handbook is an advisory 
document that contains best practices for the safe conduct of work in biomedical and clinical laboratories.  It is 
based on the principles of containment and risk assessment. 
 
8 NIH, NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules (NIH Guidelines), 
April 2016.  Accessed at http://osp.od.nih.gov/sites/default/files/resources/NIH_Guidelines.pdf on January 20, 2017.  
The NIH Guidelines specifies the practices for constructing and handling:  (i) recombinant nucleic acid molecules; 
(ii) synthetic nucleic acid molecules, including those that are chemically or otherwise modified but can base pair 
with naturally occurring nucleic acid molecules; and (iii) cells, organisms, and viruses containing such molecules.    
 
9 CDC. 2015 Annual Report of the Federal Select Agent Program, p.2.  Accessed at  
http://www.selectagents.gov/resources/FSAP_Annual_Report_2015.pdf on June 23, 2016.  An erratum to this report 
was issued November 18, 2016, and is available at 
https://www.selectagents.gov/resources/FSAP_Annual_Report_2015_ERRATUM.pdf.   
 
10 DSAT/USDA. Select Agents and Toxins Theft, Loss, or Release Document.  Accessed at 
http://www.selectagents.gov/resources/CompleteTHEFT%20LOSS%20%20RELEASE%20guidance%20document
%20June82010_FINAL.pdf on April 12, 2016.  
 
11 81 FR 9645796459 (Dec. 30, 2016) (CDC, OPHPR, Proposed Data Collection Submitted for Public Comment 
and Recommendations).  Accessed at https://www.gpo.gov/fdsys/pkg/FR-2016-12-30/pdf/2016-31740.pdf  on 
January 11, 2017.   
      
   
  39 
                                                                                                                                                                                                  
 
12 Examples of other documents that DSAT reviews may include entity plans for biosafety, biosecurity, and incident 
response; annual drill/exercise information; occupational health program plans; or entity access records.  CDC. 
Preparing For and Performing Inspections, Operations Branch (SOP Number SAPRG.INSPC.2012, effective 
August 9, 2013August 8, 2015), pp. 2936; CDC, Preparing For and Performing Inspections, Operations Branch 
(SOP Number POB.4, effective November 30, 2015November 30, 2018), pp. 37-39. 
 
13 42 CFR  73.8. 
 
14 Federal Select Agent Program, General FAQs About Select Agents and Toxins, question 12:  What Is the 
Corrective Action Plan program?  Accessed at http://www.selectagents.gov/faq-general.html on May 2, 2016. 
 
15 42 CFR  73.8. 
 
16 Ibid. 
 
17 DSAT, Division of Select Agents and Toxins: Enforcement of Select Agent and Toxin Regulations.  Accessed at 
http://www.cdc.gov/phpr/dsat/enforcement.htm on September 15, 2016.  Civil monetary penalties can be levied (up 
to $250,000 for an individual for each violation and up to $500,000 for an entity for each violation) or criminal 
enforcement can be taken (imprisonment for up to 5 years, a fine, or both). 
 
18 Office of Management and Budget, Circular A-123.  Accessed at 
https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf  on October 28, 2016. 
 
19 CDC, 90-Day Internal Review of the Select Agents and Toxins Program.  Accessed at 
http://www.cdc.gov/phpr/dsat/documents/90-day_report.pdf on September 3, 2015. 
 
20 The average number of inspections per entity from 2013 through 2015 was two.  The entity with 14 inspections is 
not typical and represents a special case.  This entity was one of only six entities registered as Biosafety Level 4 
(BSL 4).  It is also registered as a BSL 3 and a BSL 2 entity.  (See Endnote 25 for a description of BSLs.)  This 
entity had the third-highest number of Principal Investigators, the third-highest number of select agents and toxins, 
and the highest number of laboratories handling select agents and toxins.  (Principal Investigators are the individuals 
whom entities designate to direct a project or program and to be responsible to the entity for the scientific and 
technical direction of that project or program.)  In part because of these characteristics, this entity had a total of 
14 inspections:  3 Registration Renewal (announced) inspections, 4 New Space inspections, 4 Maximum 
Containment inspections, 1 Compliance (announced) inspection, and 2 Reinspection (announced) inspections.    
 
21 Three of the six entities received at least one Verification inspection, and the remaining three received one of the 
following inspection typesor a combination of themduring our review period:  Compliance, Reinspection, 
New Space, Investigation, New Entity. 
 
22 The average number of observations per entity was 29.  The entity with 161 observations is not typical and 
represents a special case, as it has the highest number of laboratories (39) of all entities in our review.  This entity is 
registered as both a BSL 2 and a BSL 3 entity.  It is also one of 5 entities with 6 Principal Investigators and 1 of 
23 entities with a total of 3 kinds of select agents or toxins.  In part because of these characteristics but also because 
of the addition of new select-agent laboratory space, this entity had a total of three inspections:  two Renewal 
(announced) inspections and one New Space inspection. 
 
23 Updates to the regulations occurred at 42 CFR  73.373.6.; these sections were amended by the final rule 
entitled Possession, Use, and Transfer of Select Agents and Toxins, Biennial Review (77 Fed. Reg. 194 (Oct. 5, 
2012)), effective December 4, 2012).  The final rule made updates pertaining to Tier 1 agents, which present the 
greatest risk of deliberate misuse with significant potential for mass casualties or devastating effect to the economy, 
critical infrastructure, or public confidence, and pose a severe threat to public health and safety.  CDC, General 
     
     
  40 
                                                                                                                                                                                                  
FAQs About Select Agents and Toxins.  Accessed at https://www.selectagents.gov/faq-general.html on 
December 13, 2016. 
 
24 The average number of TLR events per entity was five.  The entity with 56 TLR events is not typical and 
represents a special case.  This entity is one of only six entities registered as BSL 4.  This entity is also registered as 
a BSL 3 and a BSL 2 entity.  This entity has the highest number of Principal Investigators, the highest number of 
select agents and toxins, and the seventh-highest number of laboratories handling select agents and toxins. In part 
because of these characteristics, this entity had a total of 4 inspections:  1 Registration Renewal (announced) 
inspection, 1 Verification (announced) inspection, 1 Compliance (announced) inspection, and 1 Maximum 
Containment inspection.   
 
25 BSLs are assigned to entities on the basis of the type of select agents and toxins they possess, use, or transfer.  
BSLs dictate how often the entity must be inspected.  Entities designated as BSL 4the highest levelare 
authorized to use Tier 1 Select Agents and Toxins, such as the Ebola, Marburg, or smallpox viruses and are required 
to receive a minimum of two inspections per year.  Entities registered as BSL 3 are authorized to use select agents 
and toxins that cause serious or potentially lethal disease through respiratory transmission, such as Mycobacterium 
tuberculosis, the bacteria that causes tuberculosis.  Entities registered as BSL 2 work with select agents or toxins 
that pose moderate hazards to laboratorians and the environment, such as Staphylococcus aureus.   
 
26 The number of observations, inspections, TLR events, and compliance actions in 2015 in this report differ from 
those in DSATs 2015 Annual Report of the Federal Select Agent Program because we reviewed only DSAT 
entities.  In contrast, DSAT reviewed the entire select agent program in 2015 and reported aggregate numbers (i.e., 
those both from DSAT and AgSAS entities) when describing the number of inspections, observations, TLR events, 
and compliance actions.  Additionally, HHS OIG used different methods than DSAT when calculating the number 
of Corrective Action Plans in 2015.  HHS OIG calculated the number of Corrective Action Plans initiated in 2015, 
while DSAT calculated the number of entities participating in Corrective Action Plans in 2015.  This resulted in 
DSAT reporting more corrective action plans in 2015 than HHS OIG. 
 
27 These observations are the result of departures that fall under 42 CFR  73.12 but originate from guidance in other 
sources such as the Biosafety in Microbiological and Biomedical Laboratories or the NIH Guidelines.  On the basis 
of guidance from DSAT, we grouped 1,857 observations resulting from potential noncompliance with these 
documents as unclassified potential noncompliance with the regulations regarding select agents and toxins at 42 
CFR  73.12.   
     
   
  41