The number of biosafety level (BSL)-3 and BSL-4 laboratories (high- containment laboratories) began to rise in the late 1990s, accelerating after the anthrax attacks throughout the United States. The laboratories expanded across federal, state, academic, and private sectors. Information about their number, location, activities, and ownership is available for high-containment laboratories registered with CDC’s Division of Select Agent and Toxins (DSAT) or the U.S. Department of Agriculture’s (USDA) Animal and Plant Health Inspection Service (APHIS) as part of the Federal Select Agent Program. These entities register laboratories that work with select agents that have specific potential human, animal, or plant health risks. Other high-containment laboratories work with other pathogens that may also be dangerous but are not identified as “select agents” and therefore these laboratories are not required to register with DSAT or APHIS. We reported in 2009 that information about these non-select agent laboratories is not known. Our work has found that expansion of high-containment laboratories was not based on a government-wide coordinated strategy. The expansion was based on the perceptions of individual agencies about the capacity required for their individual missions and the high-containment laboratory activities needed to meet those missions, as well as the availability of congressionally approved funding. Decisions to fund the construction of high-containment laboratories were made by multiple federal agencies (e.g., Department of Health and Human Services (HHS), Department of Defense, USDA), in multiple budget cycles. Federal and state agencies, academia, and the private sector (such as drug companies) considered their individual requirements, but as we have previously reported a robust assessment of national needs was lacking. Since each agency or organization has a different mission, an assessment of needs, by definition, was at the discretion of the agency or organization. We have not found any national research agenda linking all these agencies, even at the federal level, that would allow for a national needs assessment, strategic plan, or coordinated oversight. As we last reported in 2013, after more than 12 years, we have not been able to find any detailed projections based on a government-wide strategic evaluation of research requirements based on public health or national security needs. Without this information, there is little assurance of having facilities with the right capacity to meet our national needs. This deficiency may be more critical today than 5 years ago when we first reported on this concern because current budget constraints make prioritization essential. Our work on this issue has found a continued lack of national standards for designing, constructing, commissioning, and operating high- containment laboratories. These laboratories are expensive to build, operate, and maintain. For example, we noted in our 2009 report that the absence of national standards means that the laboratories may vary from place to place because of differences in local building requirements or standards for safe operations. In 2007, while investigating a power outage at one of its recently constructed BSL-4 laboratory, CDC determined that construction workers digging at an adjacent site had some time earlier cut a critical grounding cable buried outside the building. CDC facility managers had not noticed that cutting the grounding cable had compromised the electrical system of the facility that housed the BSL-4 laboratory. It became apparent that the building’s integrity as it related to the adjacent construction had not been adequately supervised. In 2009, CDC officials told us that standard procedures under local building codes did not require monitoring of the new BSL-4 facility’s electrical grounding. This incident highlighted the risk of relying on local building codes to ensure the safety of high-containment laboratories in the absence of national standards or testing procedures specific to those laboratories. Some guidance exists about designing, constructing, and operating high- containment laboratories. The Biosafety in Microbiological and Biomedical Laboratories guidance, often referred to as BMBL recommends various design, construction and operations standards, but our work has found it is not universally followed. of whether the suggested design, construction, and operations standards are achieved. As we have recommended, national standards would be valuable for not only new laboratory construction but also periodic upgrades. Such standards need not be constrained in a “one-size fits all” model but could help specify the levels of facility performance that should be achieved. Department of Health and Human Services (Washington, D.C., 2007), Biosafety in Microbiological and Biomedical Laboratories, 5th ed. HHS has developed and provided biosafety guidelines outlined in this manual. developed by the funding or regulatory agencies. In 2013, we reported that another challenge of this fragmented oversight is the potential duplication and overlap of inspection activities in the regulation of high- containment laboratories. We recommended that CDC and APHIS work with the internal inspectors for Department of Defense and Department of Homeland Security to coordinate inspections and ensure the application of consistent inspection standards. According to most experts that we have spoken to in the course of our work, a baseline risk is associated with any high-containment laboratory. Although technology and improved scientific practice guidance have reduced the risk in high-containment laboratories, the risk is not zero (as illustrated by the recent incidents and others during the past decade). According to CDC officials, the risks from accidental exposure or release can never be completely eliminated and even laboratories within sophisticated biological research programs—including those most extensively regulated—has and will continue to have safety failures. Many experts agree that as the number of high-containment laboratories has increased, so the overall risk of an accidental or deliberate release of a dangerous pathogen will also increase. Oversight is critical in improving biosafety and ensuring that high- containment laboratories comply with regulations. However, our work has found that aspects of the current oversight programs provided by DSAT and APHIS depend on entities’ monitoring themselves and reporting incidents to the regulators. For example, with respect to a certification that a select agent had been rendered sterile (that is, noninfectious), DSAT officials told us, citing the June 2014 updated guidance, that “the burden of validating non-viability and non-functionality remains on the individual or entity possessing the select agent, toxin, or regulated nucleic acid.” While DSAT does not approve each entity’s scientific procedure, DSAT strongly recommends that “an entity maintain information on file in support of the method used for rendering a select agent non-viable . . . so that the entity is able to demonstrate that the agent . . . is no longer subject to the select agent regulations.” Biosafety select agent regulations and oversight critically rely on laboratories promptly reporting any incidents that may expose employees or the public to infectious pathogens. Although laboratories have been reasonably conscientious about reporting such incidents, there is evidence that not all have been reported promptly. The June 2014 incident in which live anthrax bacteria were transferred from a BSL-3 contained environment to lower-level (BSL-2) containment laboratories at CDC in Atlanta resulted in the potential exposure of tens of workers to the highly virulent Ames strain of anthrax. According to CDC’s report, on June 5, a laboratory scientist in the BSL-3 Bioterrorism Rapid Response and Advanced Technology (BRRAT) laboratory prepared protein extracts from eight bacterial select agents, including Bacillus anthracis, under high-containment (BSL-3) conditions.were being prepared for analysis by matrix-assisted laser desorption/ionization time-of-flight (MALDI-TOF) mass spectrometry, a relatively new technology that can be used for rapid bacterial species identification. Also, according to CDC officials that we spoke to this protein extraction procedure was being evaluated in a preliminary assessment of whether MALDI-TOF mass spectrometry could provide a cheaper and faster way to detect a range of pathogenic agents, including anthrax, compared to conventional methods and thus could be used by emergency response laboratories. According to CDC officials, the researchers intended to use the data collected in this experiment to submit a joint proposal to CDC’s Office of Public Health Preparedness and Response to fund further evaluation of the MALDI TOF method These samples because MALDI TOF is increasingly being used by clinical and hospital laboratories for infectious disease diagnostics. The protein extraction procedure was chemically based and intended to render the pathogens noninfectious, which alternative extraction procedures would have done using heat, radiation, or other chemical treatments that took longer. The procedure that was used to extract the proteins was not based on a standard operating procedure that had been documented as appropriate for all the pathogens in the experiment and reviewed by more senior scientific or management officials. Rather, the scientists used a procedure identified by the MALDI TOF equipment manufacturer that had not been tested for effectiveness, in particular, for rendering spore-forming organisms such as anthrax noninfectious. Following that procedure, the eight pathogens were exposed to chemical treatment for 10 minutes and then plated (spread on plates to test for sterility or noninfectious status) and incubated for 24 hours. According to CDC, on June 6, when no growth was observed on sterility plates after 24 hours, the remaining samples, which had been held in the chemical solution for 24 hours, were moved to CDC BSL-2 laboratories for testing using the MALDI TOF technology. Importantly, the plates containing the original sterility samples were left in the incubation chamber rather than destroyed as would normally occur because of technical problems with the autoclave that would have been used for destruction. According to CDC officials, on June 13, a laboratory scientist in the BRRAT laboratory observed unexpected growth on the anthrax sterility plate, possibly indicating that the sample was still infectious. (All the other pathogen protein samples showed no evidence of growth.) That scientist and a colleague immediately reported the discovery to the CDC Select Agent Responsible Official (RO) in accordance with the BRRAT Laboratory Incident Response Plan. That report triggered a response that immediately recovered the samples that had been sent to the BSL-2 laboratories and returned them to BSL-3 containment, and a response effort that lasted a number of days was implemented to identify any CDC employees who might have been affected by exposure to live anthrax spores. (The details of the subsequent actions and CDC’s lessons learned and proposed actions are described in CDC’s July 11, 2014, Report on Potential Exposure to Anthrax. That report indicates that none of the potentially affected employees experienced anthrax-related adverse medical symptoms.) Our preliminary analysis indicates that the BRRAT laboratory was using a MALDI-TOF MS method that had been designed for protein extraction but not for the inactivation of pathogens and that it did not have a standard operating procedure (SOP) or protocol on inactivation. We did not find a complete set of SOPs for removing agents from a BSL-3 laboratory in a safe manner. Further, neither the preparing (BRRAT BSL-3) laboratory nor the receiving laboratory (BRRAT BSL-2) laboratory conducted sterility testing. Moreover, the BRRAT laboratory did not have a kill curve based on multiple concentration levels. When we visited CDC on July 8, it became apparent to us, that a major cause of this incident was the implementation of an experiment to prepare protein extractions for testing using the MALDI TOF technology that was not based on a validated standard operating procedure. acknowledged that significant and relevant studies in the scientific literature about chemical procedures studied for preparing protein samples for use in the MALDI TOF technology, were successful in rendering tested pathogens noninfectious, except for anthrax. The literature clearly recommends an additional filtering step before concluding that the anthrax samples are not infectious. Our preliminary work indicates that this step was not followed for all the materials in this incident. Validating a procedure or method provides a defined level of statistical confidence in the results of the procedure or method. staff did not perform sterility testing on the suspension received in March 2004. CDC’s 2004 report further stated that “Research laboratory workers should assume that all inactivated B. anthracis suspension materials are infectious until inactivation is adequately confirmed [using BSL-2 laboratory procedures].” These recommendations are relevant to the June 2014 incident in Atlanta but were not followed. The laboratories receiving the protein extractions were BSL-2 laboratories, but the activities associated with testing with the MALDI TOF technology were conducted on open laboratory benches, not using biocontainment cabinets otherwise available in such laboratories. CDC’s July 11, 2014, Report on the Potential Exposure to Anthrax describes a number of actions that CDC plans to take within its responsibilities to avoid another incident like the one in June. However, we continue to believe that a national strategy is warranted that would evaluate the requirements for high-containment laboratories, set and maintain national standards for such laboratories’ construction and operation, and maintain a national strategy for the oversight of laboratories that conduct important research on highly infectious pathogens. This completes my formal statement, Chairman Murphy, Ranking Member DeGette and members of the committee. I am happy to answer any questions you may have. For future contacts regarding this statement, please contact Nancy Kingsbury at (202) 512-2700 or at kingsburyn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Sushil Sharma, Ph.D., Dr.PH, Assistant Director; and Elaine L. Vaurio also made key contributions to this statement. High-Containment Laboratories: Assessment of the Nation’s Need Is Missing. GAO-13-466R. Washington, D.C.: February 25, 2013. Biological Laboratories: Design and Implementation Considerations for Safety Reporting Systems. GAO-10-850. Washington, D.C.: September 10, 2010. High-Containment Laboratories: National Strategy for Oversight Is Needed. GAO-09-1045T. Washington, D.C.: September 22, 2009. High-Containment Laboratories: National Strategy for Oversight Is Needed. GAO-09-1036T. Washington, D.C.: September 22, 2009. High-Containment Laboratories: National Strategy for Oversight Is Needed. GAO-09-574. Washington, D.C.: September 21, 2009. Biological Research: Observations on DHS’s Analyses Concerning Whether FMD Research Can Be Done as Safely on the Mainland as on Plum Island. GAO-09-747. Washington, D.C.: July 30, 2009. High-Containment Biosafety Laboratories: DHS Lacks Evidence to Conclude That Foot-and-Mouth Disease Research Can Be Done Safely on the U.S. Mainland. GAO-08-821T. Washington, D.C.: May 22, 2008. High-Containment Biosafety Laboratories: Preliminary Observations on the Oversight of the Proliferation of BSL-3 and BSL-4 Laboratories in the United States. GAO-08-108T. Washington, D.C.: October 4, 2007. Biological Research Laboratories: Issues Associated with the Expansion of Laboratories Funded by the National Institute of Allergy and Infectious Diseases. GAO-07-333R. Washington, D.C.: February 22, 2007. Homeland Security: CDC’s Oversight of the Select Agent Program GAO-03-315R. Washington, D.C.: November 22, 2002. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Recent biosecurity incidents—such as the June 5, 2014, potential exposure of staff in Atlanta laboratories at the Centers for Disease Control and Prevention (CDC) to live spores of a strain of anthrax—highlight the importance of maintaining biosafety and biosecurity protocols at high-containment laboratories. This statement summarizes the results of GAO's past work on the oversight of high-containment laboratories, those designed for handling dangerous pathogens and emerging infectious diseases. Specifically, this statement addresses (1) the need for governmentwide strategic planning for the requirements for high-containment laboratories, including assessment of their risks; (2) the need for national standards for designing, constructing, commissioning, operating, and maintaining such laboratories; and (3) the oversight of biosafety and biosecurity at high-containment laboratories. In addition, it provides GAO's preliminary observations on the potential exposure of CDC staff to anthrax. For this preliminary work, GAO reviewed agency documents, including a report on the potential exposure, and scientific literature; and interviewed CDC officials. No federal entity is responsible for strategic planning and oversight of high-containment laboratories. Since the 1990s, the number of high-containment laboratories has risen; however, the expansion of high-containment laboratories was not based on a government-wide coordinated strategy. Instead, the expansion was based on the perceptions of individual agencies about the capacity required for their individual missions and the high-containment laboratory activities needed to meet those missions, as well as the availability of congressionally approved funding. Consequent to this mode of expansion, there was no research agenda linking all these agencies, even at the federal level, that would allow for a national needs assessment, strategic plan, or coordinated oversight. As GAO last reported in 2013, after more than 12 years, GAO has not been able to find any detailed projections based on a government-wide strategic evaluation of research requirements based on public health or national security needs. Without this information, there is little assurance of having facilities with the right capacity to meet the nation's needs. GAO's past work has found a continued lack of national standards for designing, constructing, commissioning, and operating high-containment laboratories. As noted in a 2009 report, the absence of national standards means that the laboratories may vary from place to place because of differences in local building requirements or standards for safe operations. Some guidance exists about designing, constructing, and operating high-containment laboratories. Specifically, the Biosafety in Microbiological and Biomedical Laboratories guidance recommends various design, construction, and operations standards, but GAO's work has found it is not universally followed. The guidance also does not recommend an assessment of whether the suggested design, construction, and operational standards are achieved. As GAO has reported, national standards are valuable not only in relation to new laboratory construction but also in ensuring compliance for periodic upgrades. No one agency is responsible for determining the aggregate or cumulative risks associated with the continued expansion of high-containment laboratories; according to experts and federal officials GAO interviewed for prior work, the oversight of these laboratories is fragmented and largely self-policing. On July 11, 2014, the Centers for Disease Control and Prevention (CDC) released a report on the potential exposure to anthrax that described a number of actions that CDC plans to take within its responsibilities to avoid another incident like the one in June. The incident in June was caused when a laboratory scientist inadvertently failed to sterilize plates containing samples of anthrax, derived with a new method, and transferred them to a facility with lower biosecurity protocols. This incident and the inherent risks of biosecurity highlight the need for a national strategy to evaluate the requirements for high-containment laboratories, set and maintain national standards for such laboratories' construction and operation, and maintain a national strategy for the oversight of laboratories that conduct important work on highly infectious pathogens. This testimony contains no new recommendations, but GAO has made recommendations in prior reports to responsible agencies.