To respond to these questions, we interviewed agency and industry officials, reviewed documents, and consulted with biodefense experts. We conducted our review from June 2007 through August 2007 in accordance with generally accepted government auditing standards. The Project BioShield Act of 2004 (Public Law 108-276) was designed to encourage private companies to develop civilian medical countermeasures by guaranteeing a market for successfully developed countermeasures. The Project BioShield Act (1) relaxes some procedures for bioterrorism- related procurement, hiring, and research grant awarding; (2) allows for the emergency use of countermeasures not approved by FDA; and (3) authorizes 10-year funding (available through fiscal year 2013) to encourage the development and production of new countermeasures for chemical, biological, radiological, or nuclear agents. The act also authorizes HHS to procure these countermeasures for the Strategic National Stockpile. Project BioShield procurement involves actions by HHS (including ASPR, NIAID, FDA, and the Centers for Disease Control and Prevention (CDC)) and an interagency working group. Various offices within HHS fund the development research, procurement, and storage of medical countermeasures, including vaccines, for the Strategic National Stockpile. ASPR’s role: ASPR is responsible for the entire Project BioShield contracting process, including issuing requests for information and requests for proposals, awarding contracts, managing awarded contracts, and determining whether contractors have met the minimum requirements for payment. ASPR maintains a Web site detailing all Project BioShield solicitations and awards. ASPR has the primary responsibility for engaging with the industry and awarding contracts for large-scale manufacturing of licensable products, including vaccines, for delivery into the Strategic National Stockpile. With authorities recently granted, the Biomedical Advanced Research and Development Authority (BARDA) will be able to use a variety of funding mechanisms to support the advanced development of medical countermeasures and to award up to 50 percent of the contract as milestone payments before purchased products are delivered. NIAID’s role: NIAID is the lead agency in NIH for early candidate research and development of medical countermeasures for biodefense. NIAID issues grants and awards contracts for research on medical countermeasures exploration and early development, but it has no responsibility for taking research forward into marketable products. FDA’s role: Through its Center for Biologics Evaluation and Research (CBER), FDA licenses many biological products, including vaccines, and the facilities that produce them. Manufacturers are required to comply with current Good Manufacturing Practices regulations, which regulate personnel, buildings, equipment, production controls, records, and other aspects of the vaccine manufacturing process. FDA has also established the Office of Counterterrorism Policy and Planning in the Office of the Commissioner, which issued the draft Guidance on the Emergency Use Authorization of Medical Products in June 2005. This guidance describes in general terms the data that should be submitted to FDA, when available, for unapproved products or unapproved uses of approved products that HHS or another entity wishes FDA to consider for use in the event of a declared emergency. The final emergency use authorization (EUA) guidance was issued in July 2007. CDC’s role: Since 1999, CDC has had the major responsibility for managing and deploying the medical countermeasures—such as antibiotics and vaccines—stored in the Strategic National Stockpile. DOD is not currently a part of Project BioShield. Beginning in 1998, DOD had a program to vaccinate all military service members with BioThrax. DOD’s program prevaccinates personnel being deployed to Iraq, Afghanistan, and the Korean peninsula with BioThrax. For other deployments, this vaccination is voluntary. DOD also has a program to order, stockpile, and use the licensed anthrax vaccine. DOD estimates its needs for BioThrax doses and bases its purchases on that estimate. An FDA-licensed anthrax vaccine, BioThrax, has been available since 1970. The vaccine has been recommended for a variety of situations, for example, laboratory workers who produce anthrax cultures. The BioShield program stockpiled BioThrax for the Strategic National Stockpile for postexposure use in the event of a large number of U.S. civilians being exposed to anthrax. ASPR had already acquired 10 million doses of BioThrax from Emergent BioSolutions by 2006 and recently purchased an additional 10 million doses. Three major factors contributed to the failure of the first Project BioShield procurement effort. First, ASPR awarded the first BioShield procurement contract to VaxGen when its product was at a very early stage of development and many critical manufacturing issues had not been addressed. Second, VaxGen took unrealistic risks in accepting the contract terms. Third, key parties did not clearly articulate and understand critical requirements at the outset. ASPR’s decision to launch the VaxGen procurement contract for the rPA anthrax vaccine at an early stage of development, combined with the delivery requirement for 25 million doses within 2 years, did not take the complexity of vaccine development into consideration and was overly aggressive. Citing the urgency involved, ASPR awarded the procurement contract to VaxGen several years before the planned completion of earlier and uncompleted NIAID development contracts with VaxGen and thus preempted critical development work. NIAID awarded VaxGen two development contracts, neither of which was near completion when ASPR awarded the procurement contract. However, on November 4, 2004, a little more than a year after NIAID awarded VaxGen its second development contract, ASPR awarded the procurement contract to VaxGen for 75 million doses of its rPA anthrax vaccine. At that time, VaxGen was still at least a year away from completing the Phase 2 clinical trials under the second NIAID development contract. Moreover, VaxGen was still finishing up work on the original stability testing required under the first development contract. At the time of the award, ASPR officials had no objective criteria, such as Technology Readiness Levels (TRL), to assess product maturity. They were, however, optimistic that the procurement contract would be successful. One official described its chances of success at 80 percent to 90 percent. However, a key official at VaxGen told us at the same time that VaxGen estimated the chances of success at 10 percent to 15 percent. When we asked ASPR officials why they awarded the procurement contract when they did, they pointed to a sense of urgency at that time and the difficulties in deciding when to launch procurement contracts. According to industry experts, preempting the development contract 2 years before completing work—almost half its scheduled milestones—was questionable, especially for vaccine development work, which is known to be susceptible to technical issues even in late stages of development. NIAID officials also told us it was too early for a BioShield purchase. At a minimum, the time extensions for NIAID’s first development contract with VaxGen to accommodate stability testing should have indicated to ASPR that development on its candidate vaccine was far from complete. After ASPR awarded VaxGen the procurement contract, NIAID canceled several milestones under its development contracts undermining VaxGen’s ability to deliver the required number of doses within the 2-year time frame. VaxGen officials told us that they understood their chances for success were limited and that the contract terms posed significant risks. These risks arose from aggressive time lines, VaxGen’s limitations with regard to in-house technical expertise in stability and vaccine formulation—a condition exacerbated by the attrition of key staff from the company as the contract progressed—and its limited options for securing additional funding should the need arise. Industry experts told us that a 2-year time line to deliver 75 million filled and finished doses of a vaccine from a starting point just after phase 1 trials is a near-impossible task for any company. VaxGen officials told us that at the time of the procurement award they knew the probability of success was very low, but they were counting on ASPR’s willingness to be flexible with the contract time line and work with them to achieve success. In fact, in May 2006, ASPR did extend the contract deadlines to initiate delivery to the stockpile an additional 2 years. However, on November 3, 2006, FDA imposed a clinical hold on VaxGen’s forthcoming phase 2 trial after determining that data submitted by VaxGen were insufficient to ensure that the product would be stable enough to resume clinical testing. By that time, ASPR had lost faith in VaxGen’s technical ability to solve its stability problems in any reasonable time frame. When VaxGen failed to meet a critical performance milestone to initiate the next clinical trial, ASPR terminated the contract. According to VaxGen’s officials, throughout the two development contracts and the Project BioShield procurement contract, VaxGen’s staff peaked at only 120, and the company was consistently unable to marshal sufficient technical expertise. External expertise that might have helped VaxGen better understand its stability issue was never applied. At one point during the development contracts, NIAID—realizing VaxGen had a stability problem with its product—convened a panel of technical experts in Washington, D.C. NIAID officials told us that at the time of the panel meeting, they offered to fund technical experts to work with the company, but VaxGen opted not to accept the offer. Conversely, VaxGen officials reported to us that at the time NIAID convened the panel of experts, NIAID declined to fund the work recommended by the expert panel. Finally, VaxGen accepted the procurement contract terms even though the financial constraints imposed by the BioShield Act limited its options for securing any additional funding needed. In accordance with this act, payment was conditional on delivery of a product to the stockpile, and little provision could be made, contractually, to support any unanticipated or additional development needed—for example, to work through issues of stability or reformulation. Both problems are frequently encountered throughout the developmental life of a vaccine. This meant that the contractor would pay for any development work needed on the vaccine. VaxGen, as a small biotechnology company, had limited internal financial resources and was dependent on being able to attract investor capital for any major influx of funds. However VaxGen was willing to accept the firm, fixed-price contract and assume the risks involved. VaxGen did so even though it understood that development on its rPA vaccine was far from complete when the procurement contract was awarded and that the contract posed significant inherent risks. Important requirements regarding the data and testing required for the rPA anthrax vaccine to be eligible for use in an emergency were not known at the outset of the procurement contract. They were defined in 2005 when FDA introduced new general guidance on EUA. In addition, ASPR’s anticipated use of the rPA anthrax vaccine was not articulated to all parties clearly enough and evolved over time. Finally, according to VaxGen, purchases of BioThrax raised the requirement for use of the VaxGen rPA vaccine. All of these factors created confusion over the acceptance criteria for VaxGen’s product and significantly diminished VaxGen’s ability to meet contract time lines. After VaxGen received its procurement contract, draft guidance was issued that addressed the eventual use of any unlicensed product in the stockpile. This created confusion over the criteria against which VaxGen’s product would be evaluated, strained relations between the company and the government, and caused a considerable amount of turmoil within the company as it scrambled for additional resources to cover unplanned testing. In June 2005, FDA issued draft EUA guidance, which described for the first time the general criteria that FDA would use to determine the suitability of a product for use in an emergency. This was 7 months after the award of the procurement contract to VaxGen and 14 months after the due date for bids on that contract. Since the request for proposal for the procurement contract was issued and the award itself was made before the EUA guidance was issued, neither could take the EUA requirements into consideration. The procurement contract wording stated that in an emergency, the rPA anthrax vaccine was to be “administered under a ‘Contingency Use’ Investigational New Drug (IND) protocol” and that vaccine acceptance into the stockpile was dependent on the accumulation and submission of the appropriate data to support the “use of the product (under IND) in a postexposure situation.” However, FDA officials told us they do not use the phrase “contingency use” under IND protocols. When we asked ASPR officials about the requirements for use defined in the contract, they said that the contract specifications were consistent with the statute and the needs of the stockpile. They said their contract used “a term of art” for BioShield products. That is, the contractor had to deliver a “usable product” under FDA guidelines. The product could be delivered to the stockpile only if sufficient data were available to support emergency use. ASPR officials told us that FDA would define “sufficient data” and the testing hurdles a product needed to overcome to be considered a “usable product.” According to FDA, while VaxGen and FDA had monthly communication, data requirements for emergency use were not discussed until December 2005, when VaxGen asked FDA what data would be needed for emergency use. In January 2006, FDA informed VaxGen, under its recently issued draft EUA guidance, of the data FDA would require from VaxGen for its product to be eligible for consideration for use in an emergency. The draft guidance described in general FDA’s current thinking concerning what FDA considered sufficient data and the testing needed for a product to be considered for authorization in certain emergencies. Because the EUA guidance is intended to create a more feasible protocol for using an unapproved product in a mass emergency than the term “contingency use” under an IND protocol that ASPR used in the procurement contract, it may require more stringent data for safety and efficacy. Under an IND protocol, written, informed consent must be received before administering the vaccine to any person, and reporting requirements identical to those in a human clinical trial are required. The EUA guidance—as directed by the BioShield law—eased both informed consent and reporting requirements. This makes sense in view of the logistics of administering vaccine to millions of people in the large-scale, postexposure scenarios envisioned. Because EUA guidance defines a less stringent requirement for the government to use the product, it correspondingly may require more testing and clinical trial work than was anticipated under contingency use. Several of the agencies and companies involved in BioShield-related work have told us the EUA guidance appears to require a product to be further along the development path to licensure than the previous contingency use protocols would indicate. VaxGen officials told us that if the draft EUA guidance was the measure of success, then VaxGen estimated significant additional resources would be needed to complete testing to accommodate the expectations under this new guidance. NIAID told us that the EUA guidance described a product considerably closer to licensure (85 percent to 90 percent) than it had assumed for a Project BioShield medical countermeasure (30 percent) when it initially awarded the development contracts. FDA considers a vaccine’s concept of use important information to gauge the data and testing needed to ensure the product’s safety and efficacy. According to FDA, data and testing requirements to support a product’s use in an emergency context may vary depending on many factors, including the number of people to whom the product is expected to be administered. The current use of an unlicensed product involves assessing potential risks and benefits from using an unapproved drug in a very small number of people who are in a potentially life-threatening situation. In such situations, because of the very significant potential for benefit, safety and efficacy data needed to make the risk benefit assessment might be lower than in an emergency situation where an unlicensed vaccine might be offered to millions of healthy people. This distinction is critical for any manufacturer of a product intended for use in such scenarios—it defines the level of data and testing required. Product development plans and schedules rest on these requirements. However, in late 2005, as VaxGen was preparing for the second phase 2 trial and well into its period of performance under the procurement contract, it became clear that FDA and the other parties had different expectations for the next phase 2 trial. From FDA’s perspective, the purpose of phase 2 trials was to place the product and sponsor (VaxGen) in the best position possible to design and conduct a pivotal phase 3 trial in support of licensure and not to produce meaningful safety and efficacy data to support use of the vaccine in a contingency protocol under IND as expected by VaxGen, ASPR, and CDC. This lack of a clear understanding of the concept of use for VaxGen’s product caused FDA to delay replying to VaxGen until it could confer with ASPR and CDC to clarify this issue. Thus, we conclude that neither VaxGen nor FDA understood the rPA anthrax vaccine concept of use until this meeting. The introduction of BioThrax into the stockpile undermined the criticality of getting an rPA vaccine into the stockpile and, at least in VaxGen’s opinion, forced FDA to hold it to a higher standard that the company had neither the plans nor the resources to achieve. ASPR purchased 10 million doses of BioThrax in 2005 and 2006 as a stopgap measure for post- exposure situations. The EUA guidance states that FDA will “authorize” an unapproved or unlicensed product—such as the rPA anthrax vaccine candidate—only if “there is no adequate, approved and available alternative.” According to the minutes of the meeting between FDA and VaxGen, in January 2006, FDA reported that the unlicensed rPA anthrax vaccine would be used in an emergency after the stockpiled BioThrax, that is, “when all of the currently licensed had been deployed.” This diminished the likelihood of a scenario where the rPA vaccine might be expected to be used out of the stockpile and, in VaxGen’s opinion, raised the bar for its rPA vaccine. We identified two issues related to using the BioThrax in the Strategic National Stockpile. First, ASPR lacks an effective strategy to minimize waste. As a consequence, based on current inventory, over $100 million is likely to be wasted annually, beginning in 2008. Three lots of BioThrax vaccine in the stockpile have already expired, resulting in losses of over $12 million. According to the data provided by CDC, 28 lots of BioThrax vaccine will expire in calendar year 2008. ASPR paid approximately $123 million for these lots. For calendar year 2009, 25 additional lots—valued at about $106 million—will reach their expiration dates. ASPR could minimize the potential waste of these lots by developing a single inventory system with DOD—which uses large quantities of the BioThrax vaccine— with rotation based on a first-in, first-out principle. Because DOD is a high-volume user of the BioThrax vaccine, ASPR could arrange for DOD to draw vaccine from lots long before their expiration dates. These lots could then be replenished with fresh vaccine from the manufacturer. DOD, ASPR, industry experts, and Emergent BioSolutions (the manufacturer of BioThrax) agree that rotation on a first-in, first-out basis would minimize waste. DOD and ASPR officials told us that they discussed a rotation option in 2004 but identified several obstacles. In July 2007, DOD officials believed they might not be able to transfer funds to ASPR if DOD purchases BioThrax from ASPR. However, in response to our draft report, DOD informed us that funding is not an issue. However, ASPR continues to believe that the transfer of funds would be a problem. DOD stated smallpox vaccine (Dryvax) procurement from HHS is executed under such an arrangement. Further, DOD and ASPR officials told us that they use different authorities to indemnify the manufacturer against any losses or problems that may arise from use of the vaccine. According to DOD, this area may require legislative action to ensure that vaccine purchased by ASPR can be used in the DOD immunization program. Finally, since DOD vaccinates its troops at various locations around the world, there may be logistical distribution issues. A DOD official acknowledged that these issues could be resolved. Second, ASPR plans to use expired vaccine from the stockpile, which violates FDA’s current rules. Data provided by CDC indicated that two lots of BioThrax vaccine expired in December 2006 and one in January 2007. CDC officials stated that their policy is to dispose of expired lots since they cannot be used and continuing storage results in administrative costs. FDA rules prohibit the use of expired vaccine. Nevertheless, according to CDC officials, ASPR told CDC not to dispose of the three lots of expired BioThrax vaccine. ASPR officials told us that ASPR’s decision was based on the possible need to use these lots in an emergency. ASPR’s planned use of expired vaccine would violate FDA’s current rules and could undermine public confidence because ASPR would be unable to guarantee the potency of the vaccine. The termination of the first major procurement contract for rPA anthrax vaccine raised important questions regarding the approach taken to develop a new anthrax vaccine and a robust and sustainable biodefense medical countermeasure industry by bringing pharmaceutical and biotechnology firms to form a partnership with the government. With the termination of the contract, the government does not have a new, improved anthrax vaccine for the public, and the rest of the biotech industry is now questioning whether the government can clearly define its requirements for future procurement contracts. Since HHS components have not completed a formal lessons-learned exercise after terminating VaxGen’s development and procurement contracts, these components may repeat the same mistakes in the future in the absence of a corrective plan. Articulating concepts of use and all critical requirements clearly at the outset for all future medical countermeasures would help the HHS components involved in the anthrax procurement process to avoid past mistakes. If this is not done, the government risks the future interest and participation of the biotechnology industry. Given that the amount of money appropriated to procure medical countermeasures for the stockpile is limited, it is imperative that ASPR develop effective strategies to minimize waste. Since vaccines are perishable commodities that should not be used after their expiration dates, finding other users for the stockpile products before they expire would minimize waste. Because DOD requires a large amount of the BioThrax vaccine on an annual basis, it could use a significant portion of BioThrax in the stockpile before it expires. The report that we are issuing today makes three recommendations. To avoid repeating the mistakes that led to the failure of the first rPA procurement effort, we recommend that the Secretary of HHS direct ASPR, NIAID, FDA, and CDC to ensure that the concept of use and all critical requirements are clearly articulated at the outset for any future medical countermeasure procurement. To ensure public confidence and comply with FDA’s current rules, we recommend that the Secretary of HHS direct ASPR to destroy the expired BioThrax vaccine in the stockpile. To minimize waste of the BioThrax vaccine in the stockpile, we recommend that the Secretaries of HHS and DOD develop a single integrated inventory system for the licensed anthrax vaccine, with rotation based on a first-in, first-out principle. HHS and DOD generally concurred with our recommendations. In addition, with regard to our recommendation on integrated stockpile, they identified legal challenges to developing an integrated inventory system for BioThrax in the stockpile, which may require legislative action. Although HHS and DOD use different authorities to address BioThrax liability issues, both authorities could apply to either DOD or HHS; consequently, indemnity does not appear to be an insurmountable obstacle for future procurements. Mr. Chairman, this concludes my remarks. I will be happy to answer any questions you or other members may have. For questions regarding this testimony, please contact Keith Rhodes at (202) 512-6412 or rhodesk@gao.gov. GAO staff making major contributions to this testimony included Noah Bleicher, William Carrigg, Barbara Chapman, Crystal Jones, Jeff McDermott, Linda Sellevaag, Sushil Sharma, and Elaine Vaurio. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The anthrax attacks in September and October 2001 highlighted the need to develop medical countermeasures. The Project BioShield Act of 2004 authorized the Department of Health and Human Services (HHS) to procure countermeasures for a Strategic National Stockpile. However, in December 2006, HHS terminated the contract for a recombinant protective antigen (rPA) anthrax vaccine because VaxGen failed to meet a critical contractual milestone. Also, supplies of the licensed BioThrax anthrax vaccine already in the stockpile will start expiring in 2008. GAO was asked to testify on its report on Project BioShield, which is being released today. This testimony summarizes (1) factors contributing to the failure of the rPA vaccine contract and (2) issues associated with using the BioThrax in the stockpile. GAO interviewed agency and industry officials, reviewed documents, and consulted with biodefense experts. Three major factors contributed to the failure of the first Project BioShield procurement effort for an rPA anthrax vaccine. First, HHS's Office of the Assistant Secretary for Preparedness and Response (ASPR) awarded the procurement contract to VaxGen, a small biotechnology firm, while VaxGen was still in the early stages of developing a vaccine and had not addressed many critical manufacturing issues. This award preempted critical development work on the vaccine. Also, the contract required VaxGen to deliver 25 million doses of the vaccine in 2 years, which would have been unrealistic even for a larger manufacturer. Second, VaxGen took unrealistic risks in accepting the contract terms. VaxGen officials told GAO that they accepted the contract despite significant risks due to (1) the aggressive delivery time line for the vaccine, (2) VaxGen's lack of in-house technical expertise--a condition exacerbated by the attrition of key company staff as the contract progressed--and (3) VaxGen's limited options for securing any additional funding needed. Third, important Food and Drug Administration (FDA) requirements regarding the type of data and testing required for the rPA anthrax vaccine to be eligible for use in an emergency were not known at the outset of the procurement contract. In addition, ASPR's anticipated use of the rPA anthrax vaccine was not articulated to all parties clearly enough and evolved over time. Finally, according to VaxGen, the purchase of BioThrax for the stockpile as a stopgap measure raised the bar for the VaxGen vaccine. All these factors created confusion over the acceptance criteria for VaxGen's product and significantly diminished VaxGen's ability to meet contract time lines. ASPR has announced its intention to issue another request for proposal for an rPA anthrax vaccine procurement but, along with other HHS components, has not analyzed lessons learned from the first contract's failure and may repeat earlier mistakes. According to industry experts, the lack of specific requirements is a cause of concern to the biotechnology companies that have invested significant resources in trying to meet government needs and now question whether the government can clearly define future procurement contract requirements. GAO identified two issues related with the use of the BioThrax in the Strategic National Stockpile. First, ASPR lacks an effective strategy to minimize the waste of BioThrax. Starting in 2008, several lots of BioThrax in the Strategic National Stockpile will begin to expire. As a result, over $100 million per year could be lost for the life of the vaccine currently in the stockpile. ASPR could minimize such potential waste by developing a single inventory system with DOD--a high-volume user of BioThrax--with rotation based on a first-in, first-out principle. DOD and ASPR officials identified a number of obstacles to this type of rotation that may require legislative action. Second, ASPR planned to use three lots of expired BioThrax vaccine in the stockpile in the event of an emergency. This would violate FDA rules, which prohibit using an expired vaccine, and could also undermine public confidence because the vaccine's potency could not be guaranteed.