CDC partners with the National Institutes of Health to publish Biosafety in Microbiological and Biomedical Laboratories, which provides guidance on biosafety principles and practices for protecting laboratory personnel, the public, and the environment from exposure to biological agents for each biosafety level. BSL-3 laboratories work with indigenous or exotic agents with known potential for aerosol transmission or those agents that may cause serious and potentially lethal infections. BSL-4 laboratories work with exotic agents that pose a high individual risk of life-threatening disease by aerosol transmission and for which treatment may not be available. CDC and APHIS were delegated authority by their respective department Secretaries to regulate the use, possession, and transfer of select agents. a new certificate of registration or renewing an existing registration.CDC and APHIS may also conduct interim inspections, such as annual inspections, to assess compliance with select agent regulations. High- containment laboratories may also conduct work with biological agents that have not been designated as select agents and are therefore not registered with the select agent program. Many federal departments and agencies own and operate high- containment laboratories in the United States and abroad. For example, DOD conducts and supports research on detection, identification, and characterization of biological threats and the development of medical countermeasures against those threats at its high-containment laboratories in the United States and located overseas. As part of its bioterrorism preparedness and response program, and in addition to its responsibilities for overseeing other entities’ laboratories under the select agent regulations, CDC also conducts research on potentially high-risk biological agents at its own high-containment laboratories. DOD and CDC had existing policies and procedures that addressed biosafety and biosecurity within their high-containment labs at the time the safety lapses occurred in 2014 and 2015. However, as a result of these lapses—which illustrated multiple breakdowns in compliance with established policies and procedures and inadequate oversight—both DOD and CDC have identified weaknesses in the management of their high-containment laboratories and have begun to take some steps to review and revise policies and procedures and improve monitoring and evaluation activities. DOD Steps to Address Weaknesses in Laboratory Management Our ongoing work shows that DOD has begun to take some steps to address weaknesses in the management of its high-containment laboratories but had not yet implemented them prior to the May 2015 anthrax safety lapse. After an internal reorganization in 2012, DOD began revising its policies and procedures for safeguarding select agents, including security standards for these agents, to streamline policies and improve monitoring and evaluation activities. DOD officials told us that the changes will include new requirements for all service laboratories (within Air Force, Army, and Navy) registered with the select agent program to submit all inspection reports, such as those from CDC’s select agent office, to DOD senior management regardless of inspection findings. Officials stated that, prior to this new requirement, the laboratories were required to report only what they determined to be significant findings to DOD senior management, which officials stated was no longer acceptable. DOD expects to finalize the new policy by September 2015; Air Force, Army, and Navy will have 6 months to become compliant with the updated policy once it is finalized. In addition, DOD officials told us that they identified further changes that they plan to make to this policy as a result of the May 2015 anthrax safety lapse, which they will make after the current changes are finalized. DOD plans to collect inspection reports from its select agent-registered laboratories; however, it does not plan to collect and monitor the results of any reports of inspections conducted at high-containment laboratories that are not registered with the select agent program but nonetheless conduct research on potentially high-risk biological agents. According to officials, DOD does not conduct department-level inspections of its high- containment laboratories, including those high-containment laboratories that do not conduct research with select agents and are not registered with the select agent program. Instead, DOD delegates responsibility for inspections to the services, where management responsibility for conducting or monitoring the results of laboratory inspections varies and may not lie with senior-level offices, depending upon the service. For example, DOD officials stated that high-containment Air Force laboratories are inspected by an office one level higher than the office in which the laboratory is located. Air Force officials told us that inspectors general at various levels of the service inspect Air Force laboratories. However, in our initial conversations, officials we spoke with did not tell us whether senior Air Force offices monitor the results of laboratory inspections. Our ongoing work will examine service-level responsibilities for conducting and monitoring the results of inspections and the extent to which DOD, CDC’s and APHIS’s select agent offices, the services, and the laboratories communicate and coordinate to address significant findings and resolve deficiencies identified during inspections. DOD has also begun to address weaknesses in its incident reporting requirements. DOD requires its laboratories to report potential exposures to and possible theft, loss, or misuse of select agents to CDC’s or APHIS’s select agent office, but, according to officials, DOD does not currently track these incidents or laboratories’ responses to them at the department level. DOD officials told us that the May 2015 anthrax safety lapse is the first incident that DOD has tracked at the department level; the updated biosecurity policy will include requirements for tracking exposures and other biosafety and biosecurity incidents. Our ongoing work will include an examination of the nature of DOD’s tracking and what the department might require from the laboratories or the services as a result of this tracking, such as identifying corrective actions or requiring another type of response. CDC Steps to Address Weaknesses in Laboratory Management Our ongoing work shows that CDC has begun to take a number of steps as a result of the recent safety lapses but has not yet completed implementing some agency recommendations intended to address weaknesses in its laboratory management. In October 2014, an internal workgroup established by CDC issued a report from its review of the 2014 safety lapses, which included recommendations to improve agency management of its laboratories and improve biosafety. Among its findings, the workgroup discovered considerable variation across CDC in the level of understanding, implementation, and enforcement of laboratory safety policies and quality systems. Their recommendations addressed weaknesses identified in six functional areas. Recommendations addressed weaknesses in areas of particular relevance to our ongoing work: (1) policy, authority, and enforcement; (2) training and education; and (3) communications and staff feedback. Policy, authority, and enforcement. The workgroup noted that CDC lacked overarching biosafety policies, which limits accountability and enforcement. The workgroup also noted that CDC needed clear policies and effective training for leaders and managers to help them implement accountability measures, assure competency, and enforce biosafety adherence throughout agency laboratories. To address these gaps, the workgroup recommended that CDC (1) develop agency-wide policies to communicate biosafety requirements clearly and consistently to all of its laboratories and (2) enforce existing laboratory safety policies by clarifying the positive and negative consequences of adhering or not adhering to them. Training and education. The workgroup noted that CDC’s training systems, competency and proficiency testing, and time-in-laboratory requirements varied greatly across the agency’s laboratories. The workgroup recommended a comprehensive review and unification of training and education best practices across all CDC laboratories to improve laboratory science and safety. Communications and staff feedback. The workgroup noted CDC’s need for comprehensive communication improvements to provide a transparent flow of information across the laboratory community regarding laboratory science and safety. The workgroup recommended that CDC should include clearer communication flow diagrams, point-of-decision signs, and improved notification systems to distribute information to neighboring laboratories when an event such as a potential exposure occurs. In addition, in January 2015, an external advisory group completed its review of laboratory safety at CDC and identified recommendations that reinforced the internal workgroup’s findings and recommendations. For example, this advisory group found that CDC lacked a clearly articulated safety mission, vision, or direction and recommended the creation of a biomedical scientist position in the CDC Director’s office. As we conduct our ongoing review of federal management of high- containment laboratories, we are assessing CDC’s progress in implementing the recommendations from its internal and external workgroups. Our preliminary observations show that CDC has taken some steps to implement workgroup recommendations and address weaknesses in laboratory oversight but has not addressed some recommendations or fully implemented other activities. For example, CDC reported that, in response to the recommendation to develop overarching biosafety policies, it is developing policies for specimen transport and laboratory training. In addition, CDC developed a new procedure for scientists leaving the agency to account for any biological specimens they may have been researching, which the agency rolled out in February 2015. This procedure was among those policies the workgroup recommended to be included in overarching agency policies. However, as of July 2015, CDC has not developed other agency-wide policies that include comprehensive requirements for laboratory biosafety, such as policies that outline requirements for appropriate laboratory documentation and for laboratories to maintain site-specific operational and emergency protocols, to fully address the workgroup recommendation. To address the recommendation made by the external advisory group to create a senior-level biomedical scientist position, CDC created a new Laboratory Science and Safety Office within the office of the CDC Director and established the position of Associate Director for Laboratory Science and Safety to lead the new office. The primary responsibility of the associate director is to establish additional agency- level policies for laboratory safety and communicate CDC’s safety efforts to agency staff. As of July 2015, CDC had not yet filled this position with a permanent staff member. In addition, CDC is taking other steps intended to improve the management of high-containment laboratories but has not yet completed these activities. For example, in its 2013 policy for sample and specimen management, CDC included a directive for the agency to implement an electronic inventory management system. According to officials, CDC rolled out its electronic specimen management system for inventorying biological agents to all of its infectious disease laboratories on March 30, 2015. However, CDC has not made the new system available to all agency laboratories; it expects to do so within the next 2 years. Since 2007, we have reported on several issues associated with high- containment laboratories and the risks posed by past biosafety incidents and recommended improvements for increased federal oversight. Our prior work included recommendations that address (1) the need for government-wide strategic planning for requirements for high- containment laboratories, including assessment of their risks; (2) the need for national standards for designing, constructing, commissioning, operating, and maintaining such laboratories; and (3) the need for federal oversight of biosafety and biosecurity at high-containment laboratories. HHS and other agencies to which the recommendations were directed have conducted some activities to respond but have not fully implemented most of the recommendations. For example, In our 2007 and 2009 reports, we found that the number of BSL-3 and BSL-4 laboratories in the United States had increased across federal, state, academic, and private sectors since the 2001 anthrax attacks but no federal agency was responsible for tracking this expansion. In addition, in our 2009 report we identified potential biosafety and biosecurity risks associated with an increasing number of these laboratories. We recommended that the National Security Advisor, in consultation with HHS, the Department of Homeland Security, DOD, USDA, and other appropriate federal departments, identify a single entity charged with periodic government-wide strategic evaluation of high-containment laboratories to (1) determine, among other things, the needed number, location, and mission of high- containment laboratories to meet national biodefense goals, as well as the type of federal oversight needed for these laboratories, and (2) develop national standards for the design, construction, commission, and operation of high-containment laboratories, including provisions for long-term maintenance, in consultation with the scientific community. We also recommended that HHS and USDA develop a clear definition of what constitutes exposure to select agents. The administration, HHS, and USDA have addressed some of our recommendations. For example, in 2013, the administration’s Office of Science and Technology Policy reported that it had begun to support periodic, government-wide assessments of national biodefense research and development needs and has taken some steps to examine the need for national standards for designing, constructing, commissioning, maintaining, and operating high- containment laboratories. CDC and USDA have developed scenarios to more clearly define what exposures to select agents they consider to be reportable. In our 2013 report and 2014 testimony, we found that no comprehensive assessment of the nation’s need for high-containment laboratories, including research priorities and capacity, had yet been conducted. We also found that no national standards for designing, constructing, commissioning, and operating high-containment laboratories, including provisions for long-term maintenance, had yet been developed.assigned responsibility for oversight of high-containment laboratories. In addition, no single federal entity has been In summary, the safety lapses of 2014 and 2015 continue to raise questions about the adequacy of (1) federal biosafety and biosecurity policies and procedures and (2) department and agency monitoring and evaluation activities, including appropriate levels of senior management involvement. Preliminary observations on DOD’s and CDC’s steps to address weaknesses in managing potentially high-risk biological agents in high-containment laboratories—as well as findings and recommendations from our previous work on high-containment laboratories—continue to highlight the need to consider how best the federal government as a whole and individual departments and agencies can strengthen laboratory oversight to help ensure the safety of laboratory personnel; prevent the loss, theft, or misuse of high-risk biological agents; and help recognize when individual safety lapses that appear to be isolated incidents point to systemic weaknesses, in order to help prevent safety lapses from continuing to happen. Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee, this completes our prepared statement. We would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this statement, please contact Marcia Crosse, Director, Health Care at (202) 512-7114 or crossem@gao.gov; John Neumann, Director, Natural Resources and Environment at (202) 512-3841 or neumannj@gao.gov; or Timothy M. Persons, Chief Scientist at (202) 512-6412 or personst@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Mary Denigan-Macauley, Assistant Director; Karen Doran, Assistant Director; Sushil Sharma, Assistant Director; Cheryl Arvidson; Nick Bartine; Colleen Corcoran; Shana R. Deitch; Melissa Duong; Terrance Horner, Jr.; Dan Royer; Elaine Vaurio; and Jennifer Whitworth. Appendix I: Timeline of Recent Centers for Disease Control and Prevention (CDC) Safety Lapses and Related Assessments This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Recent safety lapses at high-containment laboratories raise questions about how federal departments and agencies manage high-risk biological agents. DOD and CDC both conduct research on high-risk biological agents at their respective laboratories. Biosafety and biosecurity practices in these laboratories are intended to reduce exposure to, and prevent loss, theft, or misuse of, biological agents. CDC regulates the possession, use, and transfer of certain biological agents that pose potentially severe threats to public health under the select agent program. This statement summarizes (1) preliminary observations from ongoing GAO work on federal laboratories' biosafety and biosecurity policies and practices and (2) GAO's past work on oversight of high-containment laboratories. To conduct ongoing and past work, GAO reviewed documentation and interviewed federal agency officials, including those from DOD and CDC, about policies and procedures for high-containment laboratories; efforts to monitor compliance and evaluate effectiveness of biosafety and biosecurity policies and practices; and the status of federal oversight activities. Recent safety lapses—including shipments of live anthrax bacteria from the Department of Defense (DOD) to U.S. and international laboratories and potential exposures of Centers for Disease Control and Prevention (CDC) laboratory personnel to live anthrax bacteria—have illustrated multiple breakdowns in compliance with established policies and inadequate oversight of high-containment laboratories. In these laboratories, researchers work with potentially high-risk biological agents that may result in serious or lethal infection in humans. Preliminary observations from GAO's ongoing work show that DOD and CDC have begun to address weaknesses in the management of their high-containment laboratories, but their activities have not yet been fully implemented. GAO's ongoing work will include further examination of the status of DOD's and CDC's activities to improve management of high-containment laboratories. DOD began taking steps to address weaknesses in its management of high-containment laboratories in 2012 by reviewing and revising biosecurity policies and procedures. According to officials, the revised biosecurity policies will require all DOD laboratories that conduct research with certain high-risk biological agents to submit all inspection reports to senior DOD management, which was not previously required. DOD plans to finalize these policies by September 2015. DOD also plans to make further changes to these policies as a result of its assessment of the May 2015 anthrax incident, after the first set of revisions is finalized. DOD has also begun to track biosafety and biosecurity incidents at the senior department level, such as potential exposures to or misuse of biological agents, which it had not done prior to the May 2015 anthrax incident. DOD officials said the May 2015 incident is the first incident that DOD has tracked at the senior department level. CDC also began taking steps to address weaknesses identified in internal and external working group assessments of the June 2014 anthrax incident and other safety incidents but has not yet completed implementing some recommendations intended to improve its laboratory oversight. For example, an internal workgroup recommended that CDC develop agency-wide policies to provide clear and consistent requirements for biosafety for all agency laboratories. In response, CDC developed a specimen transport policy but has not developed other agency-wide policies, such as requirements for laboratory documentation and emergency protocols. Since 2007, GAO has reported on issues associated with high-containment laboratories and recommended improvements for federal oversight. GAO's prior work recommended the establishment of a single federal entity to (1) conduct government-wide strategic planning for requirements for high-containment laboratories, including assessment of their risks, and (2) develop national standards for designing, constructing, commissioning, operating, and maintaining such laboratories. Federal departments to which GAO's recommendations were addressed agreed with them and have conducted some activities to respond but have not implemented the recommendation to establish a single federal entity with responsibility for oversight of high-containment laboratories. GAO has previously made recommendations to agencies to enhance biosafety and biosecurity. Because this work is preliminary, GAO is making no new recommendations at this time. GAO shared preliminary observations from this statement with DOD and CDC and incorporated comments as appropriate.