High-Containment Laboratories: Improved Oversight of Dangerous Pathogens Needed to Mitigate Risk
Published: 2016-08-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Several incidents involving the shipment of live pathogens, thought to be inactivated, have recently occurred, potentially exposing people to dangerous pathogens that cause infectious diseases, such as the bacterium that causes anthrax.
GAO was asked to evaluate issues related to inactivation of pathogens in high-containment laboratories. This report examines (1) the extent to which incidents involving incomplete inactivation occurred from 2003 through 2015, (2) any challenges that may affect the implementation of inactivation in high-containment laboratories, and (3) the extent to which the Select Agent Program referred violations and enforced regulations related to incidents involving incomplete inactivation. GAO convened an expert meeting with the assistance of the National Academy of Sciences to discuss various issues surrounding inactivation. GAO also reviewed relevant laws, regulations, and guidance, and interviewed officials at laboratories that conduct inactivation.
section_title: What GAO Found
paragraphs: The total number of incidents involving incomplete inactivation—a process to destroy the hazardous effects of pathogens while retaining characteristics for future use—that occurred from 2003 through 2015 is unknown for several reasons. One key reason is that the Select Agent Program—operated by the Departments of Health and Human Services (HHS) and Agriculture (USDA) to oversee certain dangerous pathogens, known as select agents—does not require laboratories to identify such incidents on reporting forms. According to the program, 10 incidents occurred from 2003 through 2015. However, GAO identified an additional 11 incidents that the program did not initially identify. Because the program cannot easily identify incidents involving incomplete inactivation, it does not know the frequency or reason they occur, making it difficult to develop guidance to help mitigate future incidents. The 21 identified incidents involved a variety of pathogens and laboratories, as shown below.
Several challenges affect the implementation of inactivation in high-containment laboratories, including gaps in scientific knowledge and limited guidance. For example, there is limited federal guidance for researchers on the development and validation of inactivation protocols. Validation helps ensure protocols are scientifically sound and produce consistent results. Due to limited guidance, laboratories varied in their interpretation of validated methods of inactivation, resulting in researchers applying differing levels of rigor. Without more comprehensive guidance, as called for by experts, protocols will vary in their scientific soundness, increasing the risk of incomplete inactivation.
The Select Agent Program did not consistently refer incidents involving incomplete inactivation for further investigation and enforcement for violations of select agent regulations. For example, the program referred incidents involving incomplete inactivation at various laboratories, but did not refer two incidents in 2014 that occurred at HHS. A memorandum of understanding between HHS and USDA states that the program should handle incidents consistently. GAO found, however, that the program does not have a consistent, written set of criteria for handling incidents. Without such criteria, the program risks inconsistent enforcement of select agent regulations. This further highlights GAO’s previous finding that existing federal oversight of high-containment laboratories is fragmented and self-policing.
section_title: What GAO Recommends
paragraphs: GAO is making six recommendations to HHS and USDA to, among other things, improve the Select Agent Program’s oversight of inactivation by revising reporting forms, improving guidance for development and validation of inactivation protocols, and developing consistent criteria for enforcement of incidents involving incomplete inactivation. HHS and USDA agreed with GAO’s recommendations.
or John Neumann at (202) 512-3841 or neumannj@gao.gov .

section_title: Letter
paragraphs: In May 2015, the Department of Defense (DOD) discovered that one of its  laboratories inadvertently sent live Bacillus anthracis, the bacterium that  causes anthrax, to almost 200 laboratories worldwide over the course of  12 years. The laboratory believed that the samples had been inactivated,  that is, the hazardous effects of the pathogen had been destroyed while  retaining characteristics of interest for future use. In this case, DOD was  inactivating samples to support research on the detection, identification,  and characterization of biological threats. Similar incidents have occurred  in other countries, including China, where two researchers conducting  virus research were exposed to severe acute respiratory syndrome  (SARS) coronavirus samples that were incompletely inactivated. The  researchers subsequently transmitted SARS to others, leading to several  infections and one death in 2004. Researchers in high-containment  laboratories may inactivate pathogens for a variety of reasons, such as to  develop vaccines or to perform diagnostic testing or other research in a  lower safety-level laboratory. Several incidents involving incomplete  inactivation have occurred in the United States in recent years, potentially  exposing people to dangerous pathogens that can cause infectious  diseases.
Federal agencies, universities, private companies, and others operate  high-containment laboratories to conduct research on dangerous  pathogens, including developing measures to protect public and animal  health. Research is conducted on a variety of pathogens in high- containment laboratories, including pathogens classified as select agents.  Select agents include specific pathogens such as bacteria, viruses, and  toxins that have the potential to pose a severe threat to human, animal, or  plant health and safety, or to animal or plant products. The Federal  Select Agent Program (Select Agent Program) regulates the possession,  use, and transfer of select agents and is comprised of the Department of  Health and Human Services’ (HHS) Centers for Disease Control and  Prevention (CDC) Division of Select Agents and Toxins and the United  States Department of Agriculture’s (USDA) Animal and Plant Health  Inspection Service (APHIS) Agriculture Select Agent Services. In addition,  the National Institutes of Health (NIH) conducts oversight and provides  guidelines for pathogens that contain recombinant or synthetic nucleic  acid molecules. For the purpose of this report, “recombinant pathogens”  refers to pathogens that contain molecules that are constructed by joining  different nucleic acid molecules together (recombinant) or completely new  nucleic acid molecules (synthetic). Researchers routinely generate  pathogens containing recombinant or synthetic nucleic acid molecules for  a variety of purposes, including the creation of vaccines using  recombinant material.
A number of concerns have been raised in recent years surrounding the  biological safety and security of pathogens in high-containment  laboratories. For example, we previously reported on steps the CDC and  other agencies have taken to address issues identified by reviews of past  safety incidents. Additionally, we reported on issues related to oversight  of high-containment laboratories, finding that laboratories that do not work  with select agents are subject to limited federal oversight and that existing  oversight of high-containment laboratories is duplicative, fragmented, and  relies on self-policing. We have also reported on issues associated with  the proliferation of high-containment laboratories in the United States,  including risks posed by past biological safety incidents. We have made  numerous recommendations, including recommending in 2016 that  agencies update policies related to the management of high-containment  laboratories and report incidents to senior officials. Agencies have made  progress in implementing many of our recommendations but the United  States is still without a national strategy and does not have a single entity  charged with overseeing the implementation of such a strategy to identify  the aggregate risks associated with the expansion of high-containment  laboratories and the type of oversight needed. In addition, the National  Academy of Sciences, the White House, and federal committees and task  forces have raised concerns about biological safety and security,  including the management and extent of independent oversight over high- containment laboratories.
In this context, you asked us to evaluate issues related to the inactivation  of pathogens in high-containment laboratories. In this report, we  evaluated (1) the extent to which incidents involving incomplete  inactivation occurred from 2003 through 2015; (2) any challenges that  may affect the implementation of inactivation in high-containment  laboratories; and (3) the extent to which the Select Agent Program  referred violations and enforced regulations related to incidents involving  incomplete inactivation.
To conduct this work, we reviewed relevant laws, regulations, and  guidance, including guidance issued by the Select Agent Program. We  also reviewed relevant documentation and interviewed officials from the  federal departments that own and operate high-containment laboratories,  as well as officials from some academic and private high-containment  laboratories. We convened, with the assistance of the National  Academy of Sciences (NAS), a meeting with 19 experts to discuss issues  related to the inactivation of pathogens in high-containment laboratories.  These experts represented academia, the federal government, and  industry, and had combined expertise in pathogen and toxin inactivation  and control, biological safety, risk assessment, legal requirements,  standards development, incident reporting, epidemiology, and statistics.
To evaluate the extent to which incidents involving incomplete inactivation  occurred, we analyzed documentation on incidents reported to the CDC,  APHIS, and NIH since 2003—when the Select Agent Program began  requiring reporting of the theft, loss, and release of select agents— through 2015—the most recent year for which data were available. We  took several steps to determine the reliability of the agencies’ incident  databases, including reviewing agency documents and interviewing  agency officials. We determined that the Select Agent Program incident  database did not capture some incidents involving incomplete inactivation  and was therefore not reliable on its own for establishing the number of  incidents, as further discussed in the report. We verified through  interviews and documentation each incident identified in the Select Agent  Program database as well as additional incidents that we identified. We  conducted site visits for 7 of 10 high-containment laboratories and  interviewed officials from 8 of the 10 high-containment laboratories that  the Select Agent Program originally reported to us as having incidents  involving incomplete inactivation. We also interviewed officials from a  nongeneralizable sample of 19 high-containment laboratories selected to  represent a range of laboratories that work with human and animal  pathogens and biological safety levels that had not reported incidents.  We compared information learned from interviews with laboratory and  agency officials and from federal documents about the definition of  inactivation and incidents involving incomplete inactivation with comments  from our expert meeting, guidance, and our past work.
To identify challenges that potentially affected the implementation of  inactivation in high-containment laboratories, we reviewed relevant  documents, such as biological safety manuals, laboratory newsletters,  and articles from peer-reviewed literature. We also discussed challenges  that exist and safeguards applied to address these challenges in our  interviews with agency officials and researchers from high-containment  laboratories and during our expert meeting. We compared information  from our interviews with that of officials and our review of federal  documents on the development and validation of inactivation protocols  and application of safeguards with key reports related to biological safety,  expert comments, and our past work. We also compared information from  our interviews with laboratory officials and our review of related  documents on the shipment of inactivated material with expert comments  and internal controls from Standards for Internal Control in the Federal  Government.
To determine how the Select Agent Program referred violations and  enforced regulations related to incidents involving incomplete inactivation  in high-containment laboratories, we reviewed guidance, inspection  reports, and other documents from the Select Agent Program. In our  interviews with laboratory and Select Agent Program officials, we  discussed steps the Select Agent Program has taken to refer violations  and enforce regulations related to incidents involving incomplete  inactivation. We compared information we learned from our interviews  with Select Agent Program officials and our review of program documents  on the enforcement of the select agent regulations with agency guidance  on the program and internal controls from Standards for Internal Control  in the Federal Government. For further information on our objectives,  scope, and methodology, see appendix 1.
We conducted this performance audit from July 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Types of Inactivation Methods
paragraphs: Researchers use various methods in high-containment laboratories to  inactivate pathogens, as shown in figure 1, which they select depending  on the type of pathogen to be inactivated and intended use of the  inactivated material. Once a method is selected, researchers develop a  protocol that outlines a detailed plan for the scientific procedure. The  frequency with which inactivation is performed in high-containment  laboratories varies significantly, with some researchers conducting  inactivation on a daily or weekly basis and others conducting inactivation  only a few times each year.
Pathogens can be inactivated using physical, irradiation, and chemical  methods, each having advantages and disadvantages. For example,  inactivating pathogens using heat—a physical method—is generally  simple and inexpensive, but may destroy the pathogen’s protein structure,  thus rendering the pathogen useless for certain research purposes.  Inactivating pathogens using irradiation better maintains pathogens’  protein structure, but irradiators are costly for most laboratories and  subject to additional regulations and security concerns. See table 1 for  descriptions of selected types of inactivation methods and their  advantages and disadvantages.
Following inactivation, researchers may test the viability of the material to  ensure the pathogen was rendered nonviable. Different methods exist to  test the viability of a pathogen, depending on the conditions under which  the pathogen grows. For example, viability may be tested by attempting to  grow inactivated material on cultured cells or by exposing animals to  inactivated material to see if they become infected.
Key Terms Related to Pathogen Inactivation
Decontamination: the removal or count reduction of contaminating pathogens present on an  object.
Disinfection: the elimination of nearly all known pathogens but not necessarily all microbial  forms, e.g., spores on inanimate objects.
High-containment laboratory: biosafety level (BSL)-3 or 4 facilities in which studies are  conducted on a variety of dangerous pathogens and toxins.
Inactivation: a process to render infectious material (e.g., pathogens) unable to cause disease,  but retain characteristics of interest for future use.
Irradiation: exposure to radiation (e.g., ultraviolet light, gamma rays, X-rays).
Kill curve: the results of a dose-response experiment where a pathogen is subjected to  increasing amounts of the inactivating agent to determine the minimum conditions required to  render it nonviable or noninfectious.
Nonviable: a pathogen that is no longer capable of growing, replicating, infecting, or causing  disease.
Protocol: a detailed plan for a scientific procedure.
Select agent: in the United States, biological select agents (e.g., bacteria, viruses) and toxins  have the potential to pose a severe threat to public, animal, or plant health, or to animal or plant  products.
Validation: for the purpose of inactivation methods, the method must be scientifically sound and  produce consistent results each time it is used such that the expected result can be ensured.
Methods of validation may include (1) use of the exact conditions of a commonly accepted  method that has been validated, (2) a published method with adherence to the exact published  conditions, or (3) for in-house methods, validation testing should include the specific conditions  used and appropriate controls (from the Select Agent Program).
section_title: Regulation of Pathogens in High-Containment Laboratories
paragraphs: Congress passed the Public Health Security and Bioterrorism  Preparedness and Response Act of 2002 to improve the ability of the  United States to prevent, prepare for, and respond to bioterrorism and  other public health emergencies. This act was one of several acts  passed in reaction to the September 11, 2001, terrorist attacks and  subsequent anthrax incidents to combat terrorism and address increasing  concerns about biological security. It expanded HHS’s authority to  regulate select agents to include oversight of all laboratories that  possess, use, and transfer select agents affecting public health and  safety, and granted comparable authority to USDA for select agents  posing a threat to plant or animal health, or animal or plant products.  CDC’s Division of Select Agents and Toxins is responsible for the  oversight and regulation of select agents that could pose a threat to public  health and safety, such as the Ebola virus. APHIS’s Agriculture Select  Agent Services is responsible for the oversight and regulation of select  agents that could pose a threat to animal or plant health or animal or plant  products, such as the virus that causes foot-and-mouth disease. Some  select agents, such as Bacillus anthracis, are regulated by both agencies  because they pose a threat to both human and animal health. In  overseeing the Select Agent Program, CDC’s Division of Select Agents  and Toxins and APHIS’s Agriculture Select Agent Services are  responsible for ensuring that high-containment laboratories that work with  select agents comply with requirements of the select agent regulations.  They do this by inspecting laboratories that are registered with the Select  Agent Program, ensuring that individuals who work with these agents  undergo a security risk assessment, and investigating and enforcing any  incidents in which noncompliance with the regulations may have  occurred, among other responsibilities. As of May 31, 2016, a total of 286  entities were registered with the Select Agent Program. The Select  Agent Program maintains a list of select agents and toxins that they are  required to review and republish at least biennially.
section_title: Guidance on the Management of Pathogens in High- Containment Laboratories
paragraphs: NIH publishes guidelines detailing safety practices for research involving  recombinant pathogens. Compliance with the NIH guidelines is a  condition of accepting funding awards from NIH for research involving  recombinant material. As part of these guidelines, laboratories receiving  funding must report any incidents involving recombinant pathogens to  NIH. NIH has issued an incident reporting template that may be used to  report these incidents.
The Biosafety in Microbiological and Biomedical Laboratories (BMBL)  manual, although not prescriptive, is a widely-accepted source of  guidance for all research involving pathogens, regardless of whether they  are select agents or recombinant pathogens. The manual outlines the  principles and practices of biological safety and security and is published  in partnership by CDC and NIH. It applies to all biological safety levels of  microbiological laboratories, including high-containment laboratories.  According to the BMBL manual, biological safety practices are intended to  reduce or eliminate exposure of individuals and the environment to  potentially dangerous pathogens, and biological security practices are  intended to prevent the loss, theft, or misuse of dangerous pathogens and  research-related information by limiting access to facilities, research  materials, and information.
section_title: The Total Number of Incidents Involving Incomplete Inactivation of Pathogens Is Unknown
paragraphs: The total number of incidents involving incomplete inactivation that  occurred from 2003 through 2015 is unknown for several reasons,  including the inability to easily identify such incidents in existing  databases. For those that are known, incidents occurred at federal,  academic, and private high-containment laboratories and involved a  range of inactivation methods and pathogens.
subsections: section_title: The Total Number of Incidents Is Unknown Due to an Inability to Easily Identify Incidents and the Absence of Reporting Requirements and a Consistent Definition
paragraphs: The total number of incidents involving incomplete inactivation that  occurred from 2003 through 2015 is unknown for three reasons: (1) the  inability to easily identify incidents involving incomplete inactivation within  incident databases, (2) the absence of reporting requirements for  pathogens that are not select agents or recombinant pathogens, and  (3) the absence of a clear, consistent definition of inactivation.
subsections: section_title: Inability to Easily Identify Incidents
paragraphs: First, the Select Agent Program and NIH do not have the ability to easily  identify incidents involving incomplete inactivation because their incident  reporting forms are not structured to specifically identify this type of  incident. As a result, neither the Select Agent Program nor NIH (for the  oversight of recombinant pathogens) was able to provide us with an  accurate number of all incidents involving incomplete inactivation that  occurred from 2003 through 2015. Specifically, registered entities are  required by federal regulation to report any incidents of theft, loss, or  release of select agents to the Select Agent Program, where “release”  refers to any instance where pathogens are outside of primary  containment, such as an accidental spill of viable pathogens or an  incident that results in medical surveillance following an exposure,  including those resulting from incomplete inactivation. The Select Agent  Program is required to annually report to Congress only on the number  and type (e.g., “theft” or “release”) of all incidents that have occurred  involving select agents. Select Agent Program officials initially told us that  there were 10 incidents involving incomplete inactivation reported to the  program from 2003 through 2015 (see table 2). NIH officials initially told  us that they were unaware of any incidents involving incomplete  inactivation involving recombinant pathogens that had occurred in that  time frame.
However, upon review of the Select Agent Program’s database of  reported incidents, we identified another 11 incidents that involved  incomplete inactivation from 2003 through 2015, which we confirmed with  the Select Agent Program, in addition to the original list of 10 they  provided to us (see table 3).
According to officials, the Select Agent Program is not required to  specifically report the number of incidents involving incomplete  inactivation, as a subset of incidents of theft, loss, or release, to any  outside entity. Therefore, identifying this subset of incidents in the  database was difficult because reporting forms used to track the theft,  loss, and release of select agents are not structured to specifically  indicate whether an incident involved incomplete inactivation, nor require  laboratories to include “incomplete inactivation” in the description of the  incident. As a result, officials cannot easily search their databases to  identify such incidents once the information on the reporting forms is  entered into the database. According to Select Agent Program officials,  the current structure of the reporting forms could affect their  understanding of the magnitude of the problem, and a more extensive  analysis of the full report descriptions for all incidents in the database  could identify additional incidents involving incomplete inactivation.
According to the Centers for Disease Control  and Prevention (CDC), the equine  encephalitis viruses are mosquito-transmitted  diseases that can cause severe inflammation  of the brain (encephalitis) in horses and  humans. Eastern equine encephalitis (EEE)  most commonly occurs in the eastern United  States and Canada while Venezuelan equine  encephalitis (VEE) most commonly occurs in  South and Central America but has spread to  the United States.  Although a rarely seen illness in humans,  approximately 33 percent of individuals with  EEE die from the disease and many  survivors are left with significant brain  damage; infected horses have variable death  rates as high as 90 percent. VEE is the most  infectious of the equine encephalitis viruses  and the United States weaponized VEE as  an offensive incapacitating agent before the  termination of its biological weapons  program.  These viruses are highly infectious by the  aerosol route and have caused more than  160 laboratory-acquired infections, according  to the Biosafety in Microbiological and  Biomedical Laboratories (BMBL) manual.
Similar to the Select Agent Program, NIH has an incident reporting form  and requires laboratories under its purview to report incidents involving  recombinant pathogens. We identified four incidents involving incomplete  inactivation of recombinant pathogens that occurred from 2003 through  2015, which were reported to NIH but were not provided to us, through a  review of incident reporting forms (see table 4). NIH later confirmed that  these four incidents did involve incomplete inactivation. For example, due  to an equipment failure in 2014, researchers at an academic high- containment laboratory inadvertently moved viable samples of a  recombinant pathogen thought to be inactivated outside of containment.  The university reported the incident to NIH, but NIH officials did not  initially identify this incident as resulting from incomplete inactivation. As  with the Select Agent Program’s form, NIH’s reporting form for incidents  involving recombinant pathogens is not structured to specifically indicate  whether an incident involved incomplete inactivation, nor requires  laboratories to include “incomplete inactivation” in the description of the  incident, leading to difficulty in identifying such reports in its database.
These examples demonstrate challenges the Select Agent Program and  NIH have with identifying which incidents involve incomplete inactivation  for the pathogens they regulate. Because the Select Agent Program and  NIH cannot easily identify which incidents involve incomplete inactivation  on reporting forms and within incident databases, they do not know the  frequency or reason these incidents occur, making it difficult to develop  guidance to help prevent future incidents.
A CDC internal review of the Select Agent Program issued in 2015 noted  the need to include subcategories of “release,” “loss,” and other additional  fields on reporting forms to more consistently identify and categorize  incidents moving forward. In addition, Standards for Internal Control in  the Federal Government states that agencies are to employ control  activities, such as the accurate recording of events, to help ensure that  management’s directives are carried out and actions are taken to address  risks. Our prior work on safety reporting systems has noted that report  formats should allow for a sufficient description of events that align with  analysis decisions, including the ability to effectively perform root cause  analysis on high-priority issues. In addition, a 2016 report we issued on  biological safety in high-containment laboratories highlighted the  importance of analyzing all incident reports to identify potential trends.
Officials from the Select Agent Program stated that they plan to revise  their reporting forms in response to the 2015 internal CDC review  mentioned above and issue new guidance associated with the new forms,  thus allowing officials to search the database for new and more consistent  information. However, as of April 2016, Select Agent Program officials  had not yet determined what additional information to include on the  forms. Moreover, as of May 2016, NIH officials told us that they did not  plan to update their reporting form.
section_title: Absence of Reporting Requirements
paragraphs: Second, the total number of incidents involving incomplete inactivation in  high-containment laboratories that occurred from 2003 through 2015 is  unknown because federal incident reporting, in general, is required only  for (1) incidents that involve select agents, which are reportable to the  Select Agent Program; and (2) incidents that involve recombinant  pathogens, which are reportable to NIH. Thus, incidents involving  incomplete inactivation of pathogens that are neither select agents nor  recombinant pathogens, such as West Nile virus, are generally not  required to be reported to any federal agency (see fig. 2).
Reporting is required for select agents because the Select Agent Program  has determined that they have the potential to “pose a severe threat to  public and agricultural health and safety.” However, nonselect agents also  have the potential to cause disease if not properly inactivated. For  example, during the course of our review, we found an incident involving  the incomplete inactivation of Mycobacterium tuberculosis, a nonselect  agent that causes the disease tuberculosis, in one laboratory. Because  there are no federal reporting requirements for incidents involving  pathogens that are neither select agents nor recombinant pathogens, only  the laboratory in which the inactivation procedure failed was aware of the  incident. Some experts from our meeting noted that it would be beneficial  if all pathogens in high-containment received the same level of scrutiny  and had the same biological safety controls in place when leaving high  containment, whether the sample is a select agent or not. However, one  expert also noted that when the Select Agent Program was created, its  focus was more on the biological security risks associated with pathogens  rather than biological safety, which may contribute to what appears to be  an artificial distinction between select and nonselect agents for incident  reporting. As a way to address the issue of incident reporting in a broader  scope, we recommended in 2016 that federal high-containment  laboratories report all incidents, whether they involve select agents or not,  to senior agency officials.
section_title: No Clear, Consistent Definition of Inactivation
paragraphs: Third, the total number of incidents involving incomplete inactivation that  occurred from 2003 through 2015 is also unknown because there is  currently no clear and consistent definition of inactivation in guidance or  regulations issued by the Select Agent Program, NIH (for oversight of  recombinant pathogens), or the BMBL manual. As a result, researchers  may not consistently define inactivation, which potentially affects how and  when they report incidents involving incomplete inactivation. Experts at  our meeting stated there is a need for a clear, consistent definition of  inactivation across key federal guidance documents, with some experts  noting that the lack of a consistent definition can make it difficult to  understand when an incident occurs. The BMBL manual also emphasizes  the need for clear definitions to avoid misuse and confusion of key terms  used in research, but does not itself define inactivation. In addition, our  past work has shown that the use of standardized definitions is key to  ensuring that information is reported consistently.
Officials from the Select Agent Program, NIH, and CDC agreed that there  is a need for a clear and consistent definition of inactivation across  guidance documents. Specifically, the Select Agent Program is in the  process of revising the select agent regulations, which program officials  told us will include a definition of inactivation; however, the program has  received a number of comments from the public in response to these  proposed changes and officials told us that further alterations will be  made to the proposed rule before it is finalized and submitted. Officials  from NIH, responsible for the oversight of recombinant pathogens, noted  they released an update to the NIH guidelines in April 2016 and currently  do not have any other planned updates. NIH and CDC are in the  process of updating the BMBL manual and officials involved noted they  did not yet know the extent to which inactivation would be covered in the  next edition of the manual, but that they would consider any comments on  how to improve the BMBL as they move forward in the drafting process.  It is unclear to what extent the planned changes to the select agent  regulations and the BMBL manual will provide a clear and consistent  definition of inactivation. Officials from NIH responsible for recombinant  pathogens and officials in charge of the BMBL manual noted that they  would consider the results of the new select agent regulations to inform  the changes made to their own documents, as they relate to inactivation.
Without the ability to easily identify incidents involving incomplete  inactivation on reporting forms, the Select Agent Program and NIH are  unable to easily search their databases to know the frequency and  causes of incidents related to the pathogens they regulate. In addition,  without a clear and consistent definition of inactivation across key federal  guidance, researchers may not know when to include incomplete  inactivation in an incident report, potentially affecting the number of  incidents reported to the Select Agent Program and NIH (for recombinant  pathogens). Collectively, these issues prevent these agencies from  knowing the extent to which incomplete inactivation occurs and whether  these incidents are being properly identified, analyzed, and addressed.  Not knowing the magnitude of the problem may inhibit their ability to  achieve program missions of investigating any incidents in which  noncompliance may have occurred.
section_title: Identified Incidents Involving Incomplete Inactivation Occurred at a Variety of Laboratories and Involved a Range of Methods and Pathogens
paragraphs: The 21 incidents involving incomplete inactivation from 2003 through  2015 that we identified occurred at different types of high-containment  laboratories—specifically federal laboratories, academic institutions, and  private companies. In addition, these incidents involved all methods of  inactivation—including irradiation, chemical, and physical (e.g., heat)  inactivation—and a variety of pathogens (see fig. 3). Our review identified  some similarities in the 21 identified incidents involving incomplete  inactivation, with just over half of the cases occurring at federal  laboratories, over a third of incidents involving Bacillus anthracis, and  about three-quarters of the incidents involving chemical inactivation.  According to agency officials, none of the incidents involving incomplete  inactivation identified in this report resulted in human infection, severe  illness, or death. Because the total number of times inactivation is  conducted in each laboratory is unknown, it is impossible to determine the  overall risk of incomplete inactivation or the contribution of the pathogen,  type of laboratory, or method of inactivation to the overall risk.
Eight of the 21 identified incidents involving incomplete inactivation that  occurred from 2003 through 2015 involved Bacillus anthracis. This finding  reflects a theme heard during our expert meeting and interviews that  Bacillus anthracis, especially in spore form, is one of the most difficult  pathogens to inactivate. One high-profile incident occurred at DOD’s Life  Sciences Division at Dugway Proving Ground (Dugway) in Utah over the  course of 12 years, in which 575 shipments of incompletely inactivated  Bacillus anthracis were sent to 194 laboratories and contractors around  the world from 2004 through 2015 (see fig. 4). A DOD review of the  incident, completed in December 2015, determined that there was  insufficient evidence to establish a single failure as the proximate cause  for the inadvertent shipment of incompletely inactivated Bacillus  anthracis. However, the report stated that the equipment used to  irradiate the samples experienced several malfunctions. A researcher at  the facility noted that these malfunctions included a nonfunctioning  turntable, a broken motor, and misplaced indicator strips that measure the  amount of radiation being applied, which may have contributed to  incomplete inactivation. In addition, the report stated that senior  management at Dugway “allowed a culture of complacency to flourish at  the facility, resulting in laboratory personnel who did not always follow  rules, regulations, and procedures.” As a result of this incident, DOD  currently has a working group looking into best practices for the  inactivation of Bacillus anthracis by irradiation.
About three-quarters (15 of 21) of identified incidents involving incomplete  inactivation that occurred from 2003 through 2015 involved inactivation  using only chemical methods; two of these occurred at CDC in 2014. For  example, in June 2014, CDC researchers transferred samples of Bacillus  anthracis thought to be inactivated from a high-containment laboratory to  a lower safety level laboratory to test equipment used to detect  pathogens. Up to 70 staff members at CDC were potentially exposed to  viable samples. CDC determined that the overriding factor contributing  to this incident was lack of a written plan approved by senior staff or  scientific leadership to ensure that the research design was appropriate  and met all laboratory safety requirements. Another incident at CDC  involved Ebola virus samples, wherein inadequate safeguards did not  minimize human error, resulting in a potential release in December  2014. Scientists inadvertently switched samples designated for live  Ebola virus studies with samples intended for studies with inactivated  material. As a result, the samples with viable Ebola virus, instead of the  samples with inactivated Ebola virus, were transferred out of a BSL-4  laboratory to a laboratory with a lower safety level for additional analysis.  While no one contracted Ebola virus in this instance, the consequences  could have been dire for the personnel involved as there are currently no  approved treatments or vaccines for this virus. According to the BMBL  manual, there are limited treatment options for any pathogen that must be  handled in a BSL-4 laboratory.
About one-quarter (6 of 21) of identified incidents that occurred from 2003  through 2015 were related to issues with inactivation protocols—that is, a  detailed plan for how inactivation will be carried out. Specifically,  researchers used protocols from other laboratories without testing those  protocols in their own laboratories, used flawed protocols, or did not verify  the effectiveness of protocols they developed themselves. For example,  in December 2010, a researcher at a private laboratory transferred  samples of what was mistakenly thought to be inactivated Eastern equine  encephalitis virus to another laboratory. The researcher had used a  different laboratory’s protocol for chemical inactivation without verifying its  effectiveness under the conditions in his own laboratory, resulting in  incomplete inactivation of samples. In addition, following an incident at an  academic institution, researchers identified flaws in their protocol.  Specifically, they discovered that the amount of chemical in the protocol  was not enough to inactivate the samples, and that the proportion of  sample used to test for viability was not sufficient. Both of these factors  contributed to incompletely inactivated samples being removed from a  high-containment laboratory. Some experts from our meeting, as well as  researchers we interviewed, confirmed that it is important to verify a  protocol in-house before it is used. In addition, 4 of the 21 incidents that  occurred from 2003 through 2015 occurred after researchers did not  follow protocols that had previously been verified to work in their  laboratories.
Lastly, about one-quarter (5 of 21) of identified incidents that occurred  from 2003 through 2015 involved equipment or other issues (such as  mislabeling), and about one-quarter (5 of 21) of these incidents involved  issues with viability testing—either the absence of viability testing or the  removal of a sample before the viability test was complete. One incident  involved both equipment and viability testing issues. Specifically, at one  university, an equipment failure resulted in incomplete inactivation of  samples, which were not tested for viability before removing them from  containment. Researchers at the university used heat to inactivate  Burkholderia pseudomallei (the bacterium that causes Whitmore’s  Disease, a disease that primarily affects the lungs) without realizing that  the heating block had not achieved the optimal temperature to ensure  inactivation. As a result, samples that still contained viable pathogens  were unknowingly removed from containment. Officials from the university  told us that viability testing was not required before the samples were  removed from containment because they had done the inactivation step  “thousands of times” in the past, and past samples had always been  nonviable.
We identified some themes across these identified incidents, but in  general, incidents involving incomplete inactivation occurred in all types of  high-containment laboratories, involved a wide range of pathogens, and  involved a variety of methods. Moreover, different contributing factors led  to incomplete inactivation among the identified incidents, with multiple  factors contributing to some incidents. Overall, no one type of laboratory,  pathogen, inactivation method, or underlying cause was responsible for  all of the identified incidents involving incomplete inactivation that  occurred from 2003 through 2015.
section_title: Gaps in Science and Limited Guidance Affect the Implementation of Inactivation in High- Containment Laboratories
paragraphs: Several challenges affect the implementation of inactivation in high- containment laboratories including (1) gaps in the scientific knowledge of  protocol development and implementation, (2) limited federal guidance for  the development of inactivation protocols, (3) inconsistent implementation  of safeguards to help ensure inactivation is properly conducted, and  (4) varied documentation requirements for the shipment of inactivated  material. Experts in our meeting stated that such challenges may affect  laboratories’ ability to mitigate the risk of incidents involving incomplete  inactivation.
subsections: section_title: Gaps in Science Affect the Development and Implementation of Inactivation Protocols
paragraphs: Insufficient scientific information exists to guide the development and  implementation of inactivation protocols, which could result in incomplete  inactivation, according to peer-reviewed literature and our group of  experts. Moreover, a DOD report reviewing the Dugway incident stated  that a contributing factor to the release of viable pathogens were gaps in  scientific understanding of inactivation and viability testing. These  scientific gaps include:
Mechanisms of inactivation: It is important for researchers to  understand the mechanism of inactivation, according to experts from  our meeting, but this is not always clearly understood. For example,  how some chemicals, such as iodine, achieve inactivation of  pathogens is unknown, which may lead to confusion when developing  inactivation protocols. Scaling up a protocol—e.g., inactivating a  larger sample than what the protocol stipulates, with an equal  increase in the amount of the inactivating agent—may not achieve  inactivation of pathogens when using some inactivation methods but  the reasons why this occurs are unknown. In addition, officials told us  that researchers sometimes perform inactivation procedures using  manufactured chemical kits, in which the chemical composition may  be proprietary. According to experts we interviewed, it may be difficult  for researchers to determine the mechanism of inactivation and the  factors that may affect the effectiveness of such chemical kits (e.g.,  temperature or exposure time).
Repair mechanisms: Inactivation of certain pathogens can be difficult  because pathogens can sometimes reverse or repair the damage  caused by inactivation processes, according to an expert from our  meeting; however, the science as to how and to what extent repair  occurs is unknown. For example, some peer-reviewed journal articles  state that Bacillus anthracis may be able to repair itself following  inactivation, but the extent and conditions of repair processes have  not been determined. A DOD report on the Dugway incident stated  that there is limited scientific research on the ability of spores to repair  or heal themselves following irradiation.
Kill curves: Kill curves are an important calculation used to determine  the amount of exposure to an inactivating agent (e.g., an amount of  chemical, exposure time, or radiation dose) necessary to render  pathogens nonviable, according to a key textbook on inactivation.  An expert we interviewed stated that gaps in the understanding of  calculating kill curves can influence the development of inactivation  protocols and may lead to an increased risk of incomplete inactivation.  Specifically, there is not a clear understanding of how different factors  may affect the calculation of kill curves. For example, using test tubes  made of different types of material can affect the amount of  inactivating agent (e.g., radiation or heat) needed, and the  temperature at which irradiation is being performed can also influence  the calculation of the kill curve. A DOD report stated that DOD  routinely operated outside validated experimental data for the kill  curve, irradiating samples with large numbers of pathogens without  concurrently increasing the radiation dose necessary to achieve  inactivation.
Viability testing: Viability testing is a procedure to determine the  extent to which viable pathogens remain in a sample after an  inactivation process, according to experts and officials. However, the  proportion of sample needed for viability testing is not well understood  and may affect the ability of laboratories to determine if pathogens  that have undergone inactivation are still viable. More specifically, the  proportion of a sample used for testing varies greatly—anywhere from  1 to 50 percent, according to agency officials and documents—which  affects the level of confidence about the effectiveness of inactivation  procedures. In addition, experts we met with noted that it may not be  possible to prove that a sample is 100 percent inactivated without  testing 100 percent of the sample, which would leave no inactivated  material for research purposes. Therefore, there will always be an  element of uncertainty involved with inactivation of pathogens. In  addition, many factors influence the ability for pathogens to grow— including length of time, the type of media the pathogen is grown in or  on, and others—but how these factors affect pathogen growth are not  always clearly understood.
Gaps in the science of inactivation and viability testing led to ad hoc and  sometimes iterative development of protocols among some laboratories,  which could increase the risk of incomplete inactivation. For example, one  senior Dugway official told us that they would put a sample in the  irradiator until it received a dose of radiation commonly accepted to be  sufficient to inactivate Bacillus anthracis, then take it out and determine  whether it was inactivated by growing a portion of the sample and testing  it. If viable Bacillus anthracis was found, they would irradiate it for  additional time until the sample was deemed inactivated by the viability  testing procedure. Multiple such failures of inactivation at Dugway did not  initiate a review of inactivation or viability testing protocols until the  shipment of viable pathogens was discovered in May 2015.
A number of factors contribute to these scientific gaps, according to  experts and officials we interviewed. For example, there is little funding  solely dedicated to research on inactivation, making it difficult for  laboratories to conduct research to address scientific gaps on this topic.  In addition, experts from our meeting and officials from high-containment  laboratories we visited pointed out that even when research on  inactivation methods is conducted, publishing that research is sometimes  challenging because inactivation methods may be part of a larger  research question and thus not a priority for scientists or journals.  Furthermore, some journals may not publish inactivation methods if there  is no perceived impact of the research.
In 2004, researchers reported in a journal that  a manufactured chemical buffer inactivated  certain pathogens and, subsequently,  researchers in some high-containment  laboratories used this buffer for inactivation.  Several years later, other researchers  discovered that this buffer was not always  effective, finding that it did not inactivate  Ebola virus in 67 percent of samples. We  identified at least one high-containment  laboratory that had a policy to use this  chemical buffer for inactivation without testing  for viability. GAO briefed Federal Select Agent  Program officials about the inefficacy of the  chemical buffer and in January 2016, the  Federal Select Agent Program alerted  laboratories that this method was not  appropriate to inactivate select agents without  proper validation of the method.
One key theme discussed during our expert meeting was the need for  more research and sharing of such information to overcome scientific  gaps in inactivation and viability testing. Moreover, officials from the  majority of federal agencies with high-containment laboratories that we  interviewed stated that it would be beneficial to the scientific community to  better coordinate and share scientific information on inactivation. The  Federal Experts Security Advisory Panel—an interagency panel led by  HHS and USDA to address policy issues relevant to the security of select  agents—recommended in 2014 that a robust, federally-supported  program of applied biological safety research be developed and  maintained. According to HHS officials, this panel is a potential venue  for coordinating research on inactivation and viability testing across high- containment laboratories, with inactivation as one element of the broader  research agenda. USDA and other agency officials agreed that this panel  could help coordinate research. Without coordination of research and  actions taken to increase scientific information related to inactivation and  viability testing across high-containment laboratories, there may continue  to be gaps in scientific understanding of inactivation and viability testing,  increasing the risk of incomplete inactivation.
section_title: Limited Guidance Affects the Development of Inactivation Protocols
paragraphs: There is limited federal guidance for researchers on the development and  validation of inactivation protocols. Major sources for technical guidance  that researchers commonly use, such as the BMBL manual and NIH  guidelines, as well as guidance from the Select Agent Program, provide  little detailed information on development and validation of inactivation  protocols. In lieu of guidance, we found that researchers in laboratories  we visited often developed inactivation protocols at a laboratory level and  that protocols sometimes varied within the same department, agency, or  laboratory, which may increase the risk of incomplete inactivation. For  example, according to DOD documents, at the time the Dugway incident  was discovered, DOD was using different protocols for the inactivation of  Bacillus anthracis spores by irradiation at each of its high-containment  laboratories, as well as different viability testing protocols which likely  varied in effectiveness.
After protocols are developed, we found that researchers may or may not  take steps to validate their efficacy. A validated method, as defined by the  Select Agent Program for the purpose of inactivation, is a method that  must be scientifically sound and produce consistent results each time it is  used such that the expected result can be ensured. Due to limited  guidance, high-containment laboratories we visited varied in their  interpretation of what constitutes a validated method of inactivation,  resulting in researchers applying differing levels of rigor to validation of  inactivation protocols. For example, the BMBL manual and NIH guidelines  do not provide a definition of validation or give examples of what  constitutes validation of a protocol. Similarly, the select agent regulations  are currently limited in their guidance on validation of inactivation  protocols. In recent proposals to amend the select agent regulations,  CDC and APHIS suggested changes to the select agent regulations that  will require laboratories to use a validated protocol for inactivation of  dangerous pathogens to prevent the release of viable pathogens;  however, these suggested changes do not define how inactivation  protocols are to be validated. An expert from our meeting and laboratory  officials we interviewed identified concerns with the Select Agent  Program’s criteria for what constitutes the validation of a protocol. In  particular, an expert from our meeting suggested that some of the Select  Agent Program’s accepted ways of validating methods are not adequately  rigorous. For example, guidance from the Select Agent Program states  that using a published method is sufficient. However, during our meeting,  experts agreed that methods should be reproduced in each high- containment laboratory they will be used in to ensure consistent,  reproducible results.
Another key theme discussed during our expert meeting was the need for  more comprehensive and consistent federal guidance on the  development and validation of inactivation protocols. In addition, the  Federal Expert Security Advisory Panel report recommended that  institutional biosafety programs require validation of inactivation  protocols, and our past work has also emphasized the importance of  validation more generally. Without more comprehensive and consistent  federal guidance on the development and validation of inactivation  protocols, protocols will vary in their scientific soundness and  effectiveness, increasing the risk of some protocols not always achieving  inactivation.
section_title: Inconsistent Application of Safeguards Affects the Implementation of Inactivation in High- Containment Laboratories
paragraphs: secondary verification steps, such as having a second individual  observe a researcher performing the critical inactivation steps. As a  result of incidents involving transfers of potentially viable pathogens in  2014, CDC implemented policies directing the use of a verification  mechanism to ensure that critical inactivation steps were followed  every time inactivation was performed. Other high-containment  laboratories we visited had no verification mechanisms in place to  ensure inactivation procedures were followed, potentially increasing  the risk of incomplete inactivation.
Periodic updates to protocols: According to a DOD report,  laboratories should have subject matter experts periodically review  and update laboratory protocols to ensure that they have the most up- to-date knowledge. In addition, Standards for Internal Control in the  Federal Government states that agencies should accurately document  internal control activities, such as reviews and updates of their  policies. We found that the extent to which inactivation protocols  were reviewed and updated to reflect emerging scientific research  varied across laboratories. Some high-containment laboratories we  visited had a process for reviewing all of their inactivation protocols on  an annual basis while other laboratories did not. Periodically reviewing  protocols ensures that inactivation protocols are updated to reflect  emerging scientific research.
One purpose for conducting inactivation is to  create vaccines, which may use inactivated  pathogens to stimulate a person’s immune  system to produce immunity to the disease  caused by that pathogen. However,  incompletely inactivating the pathogen during  the course of developing a vaccine can have  serious consequences. For example, in 1955,  incomplete inactivation of the poliovirus  vaccine led to 40,000 cases of polio, left 51  children permanently paralyzed, and caused 5  deaths in the United States. In addition, in the  1970s and 1980s, incompletely inactivated  vaccines caused an outbreak of foot-and- mouth disease among livestock in Western  Europe. Foot-and-mouth disease is a highly  contagious disease caused by a virus that  infects cloven-hoofed animals, such as cattle,  pigs, and sheep. Foot-and-mouth disease  rarely infects humans but has a great potential  for causing severe economic loss.
Strong safety culture: Another key safeguard is having a strong  safety culture that encourages safe practices, according to laboratory  officials and experts we interviewed. We found that laboratories we  visited varied in the extent to which they focused on safety. According  to several agency officials and experts, identifying and mitigating  potential safety issues in high-containment laboratories, including  ones that may contribute to incidents involving incomplete  inactivation, requires a cultural emphasis on safety. A 2015 report to  CDC stated that leadership commitment toward safety at the agency  was inconsistent and insufficient at multiple levels. CDC officials told  us that they were taking steps to address issues related to safety  culture, and a subsequent follow-up report stated that the CDC  leadership was engaged and committed to promoting laboratory and  research safety. Issues related to safety culture have also been  identified at DOD. For example, officials at Dugway reported safety  issues beyond incidents involving incomplete inactivation and, as  noted, a DOD review from December 2015 identified issues related to  safety culture at the facility. According to officials and experts,  laboratory safety culture is enhanced by an open and transparent  environment that encourages nonpunitive reporting of incidents and  near-misses. We also found in past work that monitoring safety  culture in laboratories is important so that managers remain aware of  areas likely to lead to serious problems.
Sharing lessons learned: The sharing of lessons learned as a result  of post incident analysis can encourage the implementation of  additional safeguards, according to experts. However, we found that  laboratories varied in the extent to which they shared lessons learned.  Several high-containment laboratories we interviewed internally  shared lessons learned through newsletters, training updates, and e- mailed notices, whereas others lacked mechanisms for conveying this  information. For example, several researchers told us that they share  lessons learned within their respective high-containment laboratories,  but there are not always mechanisms in place to share this type of  information with others outside of their laboratories or agencies.  Officials from the Select Agent Program acknowledged that there  were a number of opportunities for the program to improve the sharing  of lessons learned. We reported on the importance of sharing  lessons learned in the past, recommending in March 2016 that  departments with high-containment laboratories share lessons  learned related to laboratory safety and security with laboratory  personnel within their departments.
It is important for researchers in high-containment laboratories to apply  safeguards when developing and implementing inactivation protocols to  mitigate the risk of incomplete inactivation and share information on  lessons learned, according to experts from our meeting and agency  documents. Without safeguards, officials risk not effectively implementing  inactivation, potentially leading to incomplete inactivation. According to a  CDC report, an overriding cause of the potential release of Ebola virus at  CDC was inadequate safeguards to sufficiently minimize the possibility  that human error could result in exposure to dangerous pathogens.
section_title: Varied Documentation Requirements for the Shipment of Inactivated Material Hinders Incident Mitigation
paragraphs: According to experts, once an incident involving incomplete inactivation  has taken place, documentation of the shipment of the inactivated  pathogens can provide an important safeguard, if it is still viable and  needs to be destroyed to prevent potential exposures or release.  However, we found through our review of agency documents and  interviews with agency officials that laboratories vary in their  documentation requirements for inactivated pathogens. The BMBL  manual currently provides no guidance for laboratories to create  requirements to document the transfer of inactivated material. As a result,  some laboratories document the shipment of inactivated material through  a material transfer certificate or in laboratory logbooks, but others do not  maintain any records on the movement of inactivated material. To  illustrate, DOD did not immediately know all of the places that viable  Bacillus anthracis had been sent following discovery of the Dugway  incident. According to DOD, it took several months to identify all of the  places that received viable Bacillus anthracis. Experts from our meeting  stated that documenting shipments of inactivated material would be  beneficial for facilitating the identification of laboratories that were  inadvertently shipped viable material. In addition, Standards for Internal  Control in the Federal Government states agencies are to employ control  activities, such as the accurate recording of transactions and events, to  help ensure actions are taken to address risks. Without guidance in the  BMBL manual to document the shipment of inactivated pathogens,  laboratories are at risk of being unable to locate pathogens in a timely  manner, which is important if material thought to be inactivated is  determined to still be viable. An expert noted that technologies in other  fields may facilitate the documentation of the shipment of material, as is  currently done in the food industry.
section_title: The Select Agent Program Inconsistently Referred Violations and Enforced Regulations Related to Incidents Involving Incomplete Inactivation
paragraphs: The two agencies that comprise the Select Agent Program—CDC and  APHIS—did not consistently refer incidents involving incomplete  inactivation for further investigation and enforcement to the HHS Office of  Inspector General (OIG) or APHIS’s Investigative and Enforcement  Services for violations of select agent regulations. For example, the  APHIS component of the program did not refer two 2014 incidents it was  investigating at CDC laboratories involving incomplete inactivation, while  the CDC component of the program referred a number of incidents that it  investigated at federal, private, and academic laboratories. We found  that it was unclear why some incidents were referred and enforced and  not others. Table 5 shows referral and enforcement information related to  the 21 identified incidents involving incomplete inactivation of select  agents that occurred from 2003 through 2015.
Select agents may only be transferred in a manner outlined in the select  agent regulations and any release of select agents that causes  occupational exposure or release outside of primary containment must be  reported to the Select Agent Program. Failure to report the release of a  select agent that is still viable because of incomplete inactivation, as well  as transferring these agents without proper authorization, would be a  violation of the select agent regulations. If the Select Agent Program  identifies a possible violation of the select agent regulations, several  types of enforcement actions may be taken, as follows:
Administrative actions: The Select Agent Program can suspend or  revoke a registered entity’s certification of registration, or deny an  entity’s application to possess, use, or transfer select agents.
Referrals to the HHS OIG or APHIS’s Investigative and  Enforcement Services: The Select Agent Program may refer  violations to HHS OIG or APHIS’s Investigative and Enforcement  Services, which can levy civil monetary penalties (up to $250,000 for  an individual for each violation and up to $500,000 for an entity for  each violation); issue a Notice of Violation letter; or close the case.
Referral to the FBI: The Select Agent Program can refer possible  violations involving criminal negligence, criminal intent, or suspicious  activity or person to the FBI for further investigation. Criminal  enforcement may include imprisonment for up to 5 years, a fine, or  both.
According to an interagency memorandum of understanding regarding  the Select Agent Program, CDC and APHIS should maintain consistency  in the application and enforcement of the select agent regulations. In  addition, as noted, Standards for Internal Control in the Federal  Government states that agencies are to employ control activities, such as  appropriately documenting transactions and internal controls. We found,  however, that APHIS and CDC did not use the same set of criteria for  referring violations for investigation by the HHS OIG or APHIS’s  Investigative and Enforcement Services, nor clearly documented the  bases for referring or not referring violations. Specifically, CDC has an  internal written policy that lists criteria for referrals, such as knowingly or  negligently transferring a select agent without prior authorization,  whereas APHIS has no written policy and officials verbally described the  general process to us. According to APHIS officials, they did not refer the  two 2014 CDC laboratory incidents to Investigative and Enforcement  Services because they did not believe the incidents were caused by any  clear wrongdoing or persistent issues. However, APHIS did not provide  any documentation on this decision. In other instances, the CDC  component of the Select Agent Program referred incidents that appeared  to us to be equally or less serious, yet this decision-making process was  not clearly documented for all cases.
In addition, it was unclear to us why the Select Agent Program took  certain administrative actions, such as revoking or suspending an entity’s  registration or requiring a corrective action plan, in response to some  violations and not others. For example, the program required one private  and two academic laboratories to develop corrective action plans  following incidents involving incomplete inactivation but never required  federal laboratories to develop corrective action plans following such  incidents until the widespread Dugway incident in 2015, as shown in table  5. Moreover, a CDC internal review of the Select Agent Program from  2015 also identified issues related to the program’s enforcement of  violations. In particular, the review stated that the program’s enforcement  options were limited and difficult to scale to the range of findings on  inspections and recommended that the program prioritize and strengthen  enforcement actions to the highest risk violations.
The Select Agent Program recently took some steps in an effort to  increase consistency in the application and enforcement of select agent  regulations. In responding to a draft of this report, the program provided a  draft, joint CDC-APHIS document that provides some guidance on when  to refer violations and options for enforcement actions. The program  shared this draft document with registered entities for review and  comment in June 2016. However, program officials did not provide us  with a time frame or plan for finalizing and implementing the draft  document. Moreover, it is not yet clear to what extent this document will  improve the understanding and transparency of the program’s  enforcement, and it does not define how or when decisions to refer  violations and take enforcement actions will be documented.
Without consistent criteria and documentation of decisions for referring  violations and enforcing regulations related to incidents involving  incomplete inactivation, the Select Agent Program cannot ensure that its  regulatory approach to overseeing high-containment laboratories is  applied consistently. These inconsistencies, in conjunction with our past  work, also raise larger questions about the potential limitation of the  Select Agent Program as a whole to effectively and independently  oversee high-containment laboratories, both within HHS and across other  federal agencies. Select Agent Program officials and an expert from our  group noted that the Select Agent Program is independent in its oversight  of HHS laboratories as it organizationally exists in a separate part of the  department from the HHS agencies that have high-containment  laboratories. However, as we have noted in our prior work, existing  federal oversight of high-containment laboratories is fragmented and  largely self-policing, raising questions about whether the government  framework and oversight are adequate.
section_title: Conclusions
paragraphs: Important research on dangerous pathogens depends on the ability of  researchers to inactivate these pathogens so that research can proceed  without posing an unnecessary risk to human and animal health. HHS,  DOD, and other departments and agencies have taken some initial steps  to address recent highly publicized incidents involving incomplete  inactivation at federal laboratories, such as conducting additional  research to improve inactivation methods for certain pathogens.  Nevertheless, weaknesses remain in the federal government’s oversight  of inactivation, as well as related research. In particular, without the ability  to easily identify incidents involving incomplete inactivation on reporting  forms and a clear and consistent definition of inactivation, HHS and  USDA do not know the extent to which incomplete inactivation occurs and  whether incidents are being properly identified, analyzed, and addressed.  In addition, without coordination of research and actions taken to increase  scientific information on inactivation and viability testing across high- containment laboratories, there may continue to be gaps in scientific  understanding of inactivation, increasing the risk of incomplete  inactivation. In light of the Federal Experts Security Advisory Panel’s  recommendation to develop a research program on applied biological  safety, HHS and USDA are positioned to coordinate research efforts on  inactivation and viability testing across high-containment laboratories.  Moreover, until HHS and USDA develop comprehensive and consistent  guidance on the development, validation, and implementation of  inactivation protocols—to include the application of safeguards— researchers will continue to apply differing levels of rigor, resulting in  variability in the level of scientific soundness and effectiveness of  inactivation protocols. Furthermore, in the absence of HHS guidance on  documenting the shipment of inactivated pathogens, laboratories are at  risk of being unable to locate these pathogens in a timely manner if they  are later determined to be viable, as was seen in the Dugway case.  Lastly, without consistent criteria and documentation across the Select  Agent Program for referring violations and enforcing regulations, the  Select Agent Program cannot ensure that its regulatory approach to  overseeing high-containment laboratories is applied consistently— particularly between federal and nonfederal laboratories. This risk is of  particular concern given the number of incidents at federal high- containment laboratories and raises questions about the appearance of a  lack of independence in the regulation of these laboratories. Moreover,  the challenges associated with inactivation when taken into consideration  with our past work further illustrates the challenge posed by not having a  single federal agency in charge of determining the aggregate risk  associated with high-containment laboratories. In particular, our past  findings on the risks posed by the proliferation of high-containment  laboratories and the limited federal oversight of those laboratories that do  not work with select agents highlights our concerns that existing oversight  of high-containment laboratories is fragmented, at times duplicative, and  relies on self-policing.
section_title: Recommendations for Executive Action
paragraphs: To mitigate the risk to human and animal health due to incidents involving  incomplete inactivation of dangerous pathogens used in high-containment  laboratories, we are making the following six recommendations:  To understand the extent to which incomplete inactivation occurs and  whether incidents are being properly identified, analyzed, and addressed,  we recommend that the Secretary of Health and Human Services direct  CDC and NIH and that the Secretary of Agriculture direct APHIS to: develop clear definitions of inactivation for use within their respective  guidance documents that are consistent across the Select Agent  Program, NIH’s oversight of recombinant pathogens, and the  Biosafety in Microbiological and Biomedical Laboratories manual; and  revise reporting forms within their respective areas of oversight to help  identify when incidents involving incomplete inactivation occur and  analyze the information reported to help identify the causes of  incomplete inactivation to mitigate the risk of future incidents.
To increase scientific information on inactivation and viability testing, we  recommend that the Secretaries of Health and Human Services and  Agriculture coordinate research efforts and take actions to help close  gaps in the science of inactivation and viability testing across high- containment laboratories.
To help ensure that inactivation protocols are scientifically sound and are  effectively implemented, we recommend that the Secretary of Health and  Human Services direct CDC and NIH and that the Secretary of  Agriculture direct APHIS to create comprehensive and consistent  guidance for the development, validation, and implementation of  inactivation protocols—to include the application of safeguards—across  the Select Agent Program, NIH’s oversight of recombinant pathogens,  and the Biosafety in Microbiological and Biomedical Laboratories manual.
To help ensure that dangerous pathogens can be located in the event  there is an incident involving incomplete inactivation, we recommend that  the Secretary of Health and Human Services direct the Directors of CDC  and NIH, when updating the Biosafety in Microbiological and Biomedical  Laboratories manual, to include guidance on documenting the shipment  of inactivated material.
To help ensure more consistent enforcement for violations involving  incomplete inactivation of select agents, we recommend that the  Secretary of Health and Human Services direct CDC and that the  Secretary of Agriculture direct APHIS to develop and implement  consistent criteria and documentation requirements for referring violations  to investigative entities and enforcing regulations related to incidents  involving incomplete inactivation.
section_title: Agency Comments
paragraphs: We provided a draft of this report for review and comment to USDA,  DOD, the Department of Homeland Security, HHS, the Department of the  Interior, and the Environmental Protection Agency (EPA). Written  responses from USDA, DOD, and HHS are reprinted in appendixes III  through V. The Department of Homeland Security, the Department of the  Interior, and EPA did not provide written comments. Of the two  departments to which we made recommendations, both USDA and HHS  agreed with all recommendations. In their written responses, they  provided additional information about steps they are taking to improve  biological safety and security in high-containment laboratories and to  address our recommendations. For example, in October 2015, HHS  created a biological safety and security council to coordinate and  collaborate across the department. In addition, in response to our  recommendation that HHS and USDA coordinate research efforts on the  science of inactivation and viability testing, the departments stated that  they are taking steps to develop a federally-supported program to  improve laboratory biological safety, including examining current gaps  related to inactivation. HHS and USDA also described other actions that  are underway, including revising the select agent regulations, which they  stated that they expect to finalize in October 2016, and developing  guidance on enforcement of regulations. USDA, HHS, and DOD also  provided technical comments, which we incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees; the Secretaries of Agriculture,  Defense, Health and Human Services, Homeland Security, and the  Interior; the Administrator of EPA; and other interested parties. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions concerning this report,  please contact Timothy M. Persons, Chief Scientist, at (202) 512-6412 or  personst@gao.gov or John Neumann, Director, Natural Resources and  Environment, at (202) 512-3841 or neumannj@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. Key contributors to the report are  listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report evaluates (1) the extent to which incidents involving  incomplete inactivation occurred from 2003 through 2015; (2) any  challenges that may affect the implementation of inactivation in high- containment laboratories; and (3) the extent to which the Select Agent  Program referred violations and enforced regulations related to incidents  involving incomplete inactivation.
To address our objectives, we reviewed relevant laws, regulations, and  guidance, including the Biosafety in Microbiological and Biomedical  Laboratories (BMBL) manual and guidance issued by the Select Agent  Program. We also reviewed relevant documentation and interviewed  officials from the federal departments that own and operate high- containment laboratories (biological safety level (BSL)-3, BSL-4, or both),  as well as officials from some academic and private high-containment  laboratories. The federal departments and their component agencies  were the Department of Homeland Security; the Department of Defense  (DOD) and its departments of the Army, Navy, and Air Force;  Department of Energy and its National Nuclear Security Administration  and Office of Science; Department of the Interior and its Fish and Wildlife  Service and U.S. Geological Survey; Department of Veterans Affairs and  its Veterans Health Administration; Department of Health and Human  Services (HHS) and its components of Centers for Disease Control and  Prevention (CDC), Food and Drug Administration, and the National  Institutes of Health (NIH); United States Department of Agriculture  (USDA) and its Animal and Plant Health Inspection Service (APHIS),  Agricultural Research Service, and Food Safety and Inspection Service;  and the United States Environmental Protection Agency (EPA). According  to officials from the Department of Veterans Affairs, Interior’s Fish and  Wildlife Service, and EPA, inactivation is not conducted in any of their  high-containment laboratories so we excluded them from our scope. In  addition, the Department of Energy’s Office of Science has not operated a  high-containment laboratory since 2006, so we also excluded it from our  scope.
To obtain expert views on inactivation related to all of our objectives, we  convened a meeting with 19 experts to discuss various issues  surrounding inactivation of pathogens in high-containment laboratories.  This meeting was held at the National Academy of Sciences (NAS) in  February 2016, and staff at NAS assisted in identifying experts for this  meeting. To identify the experts appropriate for the meeting, we worked  iteratively with NAS staff to identify and review biographical information  and relevant qualifications of experts, as well as factors such as  representation from academia, industry, and federal government and  expertise in a range of areas. The Board on Life Sciences of NAS  solicited nominations for the expert panel from its extensive contacts in  the biology and risk assessment community, academia, and organizations  interested in biodefense. These contacts included current and former  committee members, current and former members of NAS’s Board on Life  Sciences, and select members of NAS. NAS initially identified a list of  approximately 110 nominees. From this initial list, NAS selected experts  based on their knowledge and expertise in pathogen and toxin  inactivation and control, biological safety, risk assessment, legal  requirements, standards development, incident reporting, epidemiology,  and statistics, as well as their experience in academic, industry, and  federal government sectors. In order to facilitate discussion among  participants, NAS did not include any federal government employees from  the Select Agent Program. Once we came to agreement with NAS on the  final list of 19 experts for the meeting, these experts were evaluated for  any conflicts of interest. A conflict of interest was considered to be any  current financial or other interest that might conflict with the service of an  individual because it (1) could impair objectivity and (2) could create an  unfair competitive advantage for any person or organization. We  discussed internally all potential conflicts. The 19 experts were  determined to be free of conflicts of interest, and the group as a whole  was judged to have no inappropriate biases. See appendix II for a list of  the experts.
The 2-day expert meeting was comprised of eight sessions covering a  range of topics, such as incidents involving incomplete inactivation,  scientific issues, and standards and guidance. We developed the session  topics based on our researchable objectives and issues that were  identified in our audit work, including our review of the peer-reviewed  literature, analysis of agency documents, and interviews with agency and  laboratory officials. The meeting was recorded and transcribed to ensure  that we accurately captured the experts’ statements, and we reviewed  and analyzed the transcripts as a source of evidence. Although the expert  meeting was not designed to reach a formal consensus on the issues, a  number of themes emerged from the group’s discussion to which there  was general agreement. The group generally agreed on various issues  and had several suggestions for how to address them. Following the  meeting, we asked five of the experts to review our draft report to ensure  expert comments and scientific concepts were appropriately captured. In  selecting experts to review our draft, we first excluded all foreign  individuals because the draft had not undergone a sensitivity review, as  well as all federal officials because federal agencies had separate  opportunities to comment on the draft during the agencies’ official  comment period. Then, from the remaining experts, we selected experts  to represent a range of expertise, including (1) one expert from industry,  (2) one biological safety officer, (3) one policy expert, (4) one director of a  high-containment laboratory, and (5) one individual with legal expertise.  We incorporated comments from these experts into our final report.
To evaluate the extent to which incidents involving incomplete inactivation  occurred, we analyzed documentation on incidents reported to the CDC,  APHIS, and NIH since 2003—when reporting of incidents involving the  theft, loss, and release of select agents was first required under the  Select Agent Program—through 2015—the most recent year for which  data were available. We also interviewed officials from CDC and APHIS  on the reporting of incidents to the Select Agent Program, and officials  from NIH on the reporting of incidents involving recombinant pathogens.  We took several steps to determine the reliability of the agencies’ incident  databases, including interviewing agency officials and reviewing agency  documents. We determined that the Select Agent Program incident  database did not capture some cases of inactivation and was therefore  not reliable on its own for establishing the number of incidents. We  verified through interviews and documentation each incident identified in  the Select Agent Program database as well as additional incidents that  we identified. We conducted site visits for 7 of 10 high-containment  laboratories and interviewed officials from 8 of the 10 high-containment  laboratories at which incidents involving incomplete inactivation were  originally reported to us by the Select Agent Program. We contacted  officials from all 10 high-containment laboratories at which incidents  involving incomplete inactivation were originally reported to us to arrange  interviews; however, officials from one university and one private  laboratory declined to be interviewed. We also interviewed officials from a  nongeneralizable sample of 19 high-containment laboratories across the  country that had not reported incidents, which were generally selected to  represent a range of high-containment laboratories that work with human  and animal pathogens and biological safety levels. The views of these  officials are not generalizable to all laboratories, but they provide  illustrative examples. We also interviewed officials from the Department of  Labor’s Occupational Health and Safety Administration and HHS’s  National Institute for Occupational Safety and Health to determine if they  were aware of any incidents involving incomplete inactivation at high- containment laboratories. Because these agencies were not aware of any  incidents involving incomplete inactivation and did not have any  requirements related to the reporting of such incidents, we did not include  them in our additional work.
We compared information learned from interviews with laboratory and  agency officials and from federal documents about the definition of  inactivation and incidents involving incomplete inactivation with comments  from our expert meeting, the BMBL manual, and our past work.  Specifically, experts, the BMBL manual, and our past work emphasized  the need for clear definitions to avoid confusion and maintain consistent  reporting. In this respect, we considered the extent to which the  definitions were consistent across the Select Agent Program, NIH’s  oversight of recombinant pathogens, and the BMBL manual. We also  analyzed reporting forms for identification of incidents involving  incomplete inactivation from the Select Agent Program and NIH’s  oversight of recombinant pathogens.
To identify challenges that potentially affect the implementation of  inactivation in high-containment laboratories, we reviewed relevant  documents, such as inactivation protocols, biological safety manuals,  laboratory newsletters, and articles from peer-reviewed literature. We also  discussed challenges that exist and safeguards applied to address these  challenges in our interviews with agency officials and researchers from  high-containment laboratories and during our expert meeting. We also  interviewed officials from the Department of Commerce’s National  Institute of Standards and Technology to learn more about the process for  developing scientific standards, and officials from CDC’s Laboratory  Response Network to discuss standard protocols used by the network.  We compared information we learned from our interviews with that of  agency and laboratory officials and our review of federal documents on  the development and validation of inactivation protocols and application of  safeguards with key reports related to biological safety, expert comments,  and our past work. In particular, we considered the extent to which  current guidance was consistent with a Federal Expert Security Advisory  Panel report that recommended that institutional biosafety programs  require validation of all standard operating procedures for inactivation;  our past work, which has emphasized the importance of validation more  generally; and comments during our expert meeting, which emphasized  the need to apply safeguards when developing and carrying out  inactivation protocols. We also compared information from our interviews  with laboratory officials and our review of related documents on the  shipment of inactivated material with expert comments and internal  controls from Standards for Internal Control in the Federal Government.
To determine how the Select Agent Program referred violations and  enforced regulations related to incidents involving incomplete inactivation  in high-containment laboratories, we reviewed guidance, inspection  reports, and other documents from the Select Agent Program, APHIS’s  Investigative and Enforcement Services, and the USDA and HHS Offices  of Inspector General (OIG). In our interviews with laboratory and Select  Agent Program officials, we discussed steps the Select Agent Program  has taken to refer violations and enforce regulations related to incidents  involving incomplete inactivation. We also interviewed officials from the  Investigative and Enforcement Services and HHS and USDA OIG to  better understand their processes for enforcing the select agent  regulations. We compared information we learned from our interviews  with Select Agent Program officials and our review of program documents  on the enforcement of violations of the select agent regulations with  agency guidance on the program and internal controls from Standards for  Internal Control in the Federal Government. In particular, an interagency  memorandum of understanding on the Select Agent Program states that  agencies should maintain consistency in the application and enforcement  of select agent regulations, and Standards for Internal Control in the  Federal Government states that agencies are to employ control activities,  such as appropriately documenting transactions and internal controls. We  considered the extent to which enforcement referrals and actions were  consistent with these documents.
We conducted this performance audit from July 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: List of Experts
paragraphs: The names and affiliations of the experts who participated in the group  discussion held February 11-12, 2016 in Washington, D.C., are as  follows:
Allan Bennett, Ph.D., General Project Manager, Public Health
Robert Buchanan, Ph.D., Professor, University of Maryland
Lawrence Blyn, Ph.D., Senior Director, Ibis Biosciences, Abbott
Charles Gerba, Ph.D., Professor, University of Arizona
Joshua Goldberg, J.D., Attorney, Goldberg Legal Services
Jens-Peters Gregersen, Ph.D., GlaxoSmithKline Vaccines
Gigi Kwik Gronvall, Ph.D., Senior Associate, University of Pittsburgh
Molly Isbell, Ph.D., Director, Signature Science
Richard Jaffe, Ph.D., Director, Medical Countermeasure Strategy &  Requirements Division, Office of Policy and Planning, Assistant  Secretary for Preparedness and Response, Department of Health and  Human Services
Barbara Johnson, Ph.D., Owner, Biosafety Biosecurity International
Thomas Ksiazek, Ph.D., Professor, University of Texas Medical  Jens Kuhn, Ph.D., Lead Virologist, Integrated Research Facility at  Fort Detrick
Justin Lessler, Ph.D., Associate Professor, Johns Hopkins University
Benito Marinas, Ph.D., Professor, University of Illinois
Brian O’Shea, Ph.D., Senior Biological Safety Officer, Battelle
Karlene Roberts, Ph.D., Professor Emeritus, University of California,  Berkeley
Sophie Smither, Ph.D., Principal Scientist, Defence Science and  Jeanette Thurston-Enriquez, Ph.D., Science Program and Analysis  Officer, United States Department of Agriculture
David Wunschel, Ph.D., Staff Scientist, Pacific Northwest National  The comments of most of these experts represented the views of the  experts themselves and not the agency, university, or company they are  affiliated with.
section_title: Appendix III: Comments from the Department of Agriculture
section_title: Appendix IV: Comments from the Department of Defense
section_title: Appendix V: Comments from the Department of Health and Human Services
section_title: Appendix VI: Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, Mary Denigan-Macauley  (Assistant Director), Sushil Sharma (Assistant Director), Pille Anvelt, Amy  Bowser, Caitlin Dardenne, Ashley Grant, Dani Greene, Ushna Ilyas,  Lesley Rinner, Amber Sinclair, and Elizabeth Wood made key  contributions to this report.