Researchers use various methods in high-containment laboratories to inactivate pathogens, as shown in figure 1, which they select depending on the type of pathogen to be inactivated and intended use of the inactivated material. Once a method is selected, researchers develop a protocol that outlines a detailed plan for the scientific procedure. The frequency with which inactivation is performed in high-containment laboratories varies significantly, with some researchers conducting inactivation on a daily or weekly basis and others conducting inactivation only a few times each year. Pathogens can be inactivated using physical, irradiation, and chemical methods, each having advantages and disadvantages. For example, inactivating pathogens using heat—a physical method—is generally simple and inexpensive, but may destroy the pathogen’s protein structure, thus rendering the pathogen useless for certain research purposes. Inactivating pathogens using irradiation better maintains pathogens’ protein structure, but irradiators are costly for most laboratories and subject to additional regulations and security concerns. See table 1 for descriptions of selected types of inactivation methods and their advantages and disadvantages. Following inactivation, researchers may test the viability of the material to ensure the pathogen was rendered nonviable. Different methods exist to test the viability of a pathogen, depending on the conditions under which the pathogen grows. For example, viability may be tested by attempting to grow inactivated material on cultured cells or by exposing animals to inactivated material to see if they become infected. Key Terms Related to Pathogen Inactivation Decontamination: the removal or count reduction of contaminating pathogens present on an object. Disinfection: the elimination of nearly all known pathogens but not necessarily all microbial forms, e.g., spores on inanimate objects. High-containment laboratory: biosafety level (BSL)-3 or 4 facilities in which studies are conducted on a variety of dangerous pathogens and toxins. Inactivation: a process to render infectious material (e.g., pathogens) unable to cause disease, but retain characteristics of interest for future use. Irradiation: exposure to radiation (e.g., ultraviolet light, gamma rays, X-rays). Kill curve: the results of a dose-response experiment where a pathogen is subjected to increasing amounts of the inactivating agent to determine the minimum conditions required to render it nonviable or noninfectious. Nonviable: a pathogen that is no longer capable of growing, replicating, infecting, or causing disease. Protocol: a detailed plan for a scientific procedure. Select agent: in the United States, biological select agents (e.g., bacteria, viruses) and toxins have the potential to pose a severe threat to public, animal, or plant health, or to animal or plant products. Validation: for the purpose of inactivation methods, the method must be scientifically sound and produce consistent results each time it is used such that the expected result can be ensured. Methods of validation may include (1) use of the exact conditions of a commonly accepted method that has been validated, (2) a published method with adherence to the exact published conditions, or (3) for in-house methods, validation testing should include the specific conditions used and appropriate controls (from the Select Agent Program). Congress passed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 to improve the ability of the United States to prevent, prepare for, and respond to bioterrorism and other public health emergencies. This act was one of several acts passed in reaction to the September 11, 2001, terrorist attacks and subsequent anthrax incidents to combat terrorism and address increasing concerns about biological security. It expanded HHS’s authority to regulate select agents to include oversight of all laboratories that possess, use, and transfer select agents affecting public health and safety, and granted comparable authority to USDA for select agents posing a threat to plant or animal health, or animal or plant products. CDC’s Division of Select Agents and Toxins is responsible for the oversight and regulation of select agents that could pose a threat to public health and safety, such as the Ebola virus. APHIS’s Agriculture Select Agent Services is responsible for the oversight and regulation of select agents that could pose a threat to animal or plant health or animal or plant products, such as the virus that causes foot-and-mouth disease. Some select agents, such as Bacillus anthracis, are regulated by both agencies because they pose a threat to both human and animal health. In overseeing the Select Agent Program, CDC’s Division of Select Agents and Toxins and APHIS’s Agriculture Select Agent Services are responsible for ensuring that high-containment laboratories that work with select agents comply with requirements of the select agent regulations. They do this by inspecting laboratories that are registered with the Select Agent Program, ensuring that individuals who work with these agents undergo a security risk assessment, and investigating and enforcing any incidents in which noncompliance with the regulations may have occurred, among other responsibilities. As of May 31, 2016, a total of 286 entities were registered with the Select Agent Program. The Select Agent Program maintains a list of select agents and toxins that they are required to review and republish at least biennially. NIH publishes guidelines detailing safety practices for research involving recombinant pathogens. Compliance with the NIH guidelines is a condition of accepting funding awards from NIH for research involving recombinant material. As part of these guidelines, laboratories receiving funding must report any incidents involving recombinant pathogens to NIH. NIH has issued an incident reporting template that may be used to report these incidents. The Biosafety in Microbiological and Biomedical Laboratories (BMBL) manual, although not prescriptive, is a widely-accepted source of guidance for all research involving pathogens, regardless of whether they are select agents or recombinant pathogens. The manual outlines the principles and practices of biological safety and security and is published in partnership by CDC and NIH. It applies to all biological safety levels of microbiological laboratories, including high-containment laboratories. According to the BMBL manual, biological safety practices are intended to reduce or eliminate exposure of individuals and the environment to potentially dangerous pathogens, and biological security practices are intended to prevent the loss, theft, or misuse of dangerous pathogens and research-related information by limiting access to facilities, research materials, and information. The total number of incidents involving incomplete inactivation that occurred from 2003 through 2015 is unknown for several reasons, including the inability to easily identify such incidents in existing databases. For those that are known, incidents occurred at federal, academic, and private high-containment laboratories and involved a range of inactivation methods and pathogens. The total number of incidents involving incomplete inactivation that occurred from 2003 through 2015 is unknown for three reasons: (1) the inability to easily identify incidents involving incomplete inactivation within incident databases, (2) the absence of reporting requirements for pathogens that are not select agents or recombinant pathogens, and (3) the absence of a clear, consistent definition of inactivation. First, the Select Agent Program and NIH do not have the ability to easily identify incidents involving incomplete inactivation because their incident reporting forms are not structured to specifically identify this type of incident. As a result, neither the Select Agent Program nor NIH (for the oversight of recombinant pathogens) was able to provide us with an accurate number of all incidents involving incomplete inactivation that occurred from 2003 through 2015. Specifically, registered entities are required by federal regulation to report any incidents of theft, loss, or release of select agents to the Select Agent Program, where “release” refers to any instance where pathogens are outside of primary containment, such as an accidental spill of viable pathogens or an incident that results in medical surveillance following an exposure, including those resulting from incomplete inactivation. The Select Agent Program is required to annually report to Congress only on the number and type (e.g., “theft” or “release”) of all incidents that have occurred involving select agents. Select Agent Program officials initially told us that there were 10 incidents involving incomplete inactivation reported to the program from 2003 through 2015 (see table 2). NIH officials initially told us that they were unaware of any incidents involving incomplete inactivation involving recombinant pathogens that had occurred in that time frame. However, upon review of the Select Agent Program’s database of reported incidents, we identified another 11 incidents that involved incomplete inactivation from 2003 through 2015, which we confirmed with the Select Agent Program, in addition to the original list of 10 they provided to us (see table 3). According to officials, the Select Agent Program is not required to specifically report the number of incidents involving incomplete inactivation, as a subset of incidents of theft, loss, or release, to any outside entity. Therefore, identifying this subset of incidents in the database was difficult because reporting forms used to track the theft, loss, and release of select agents are not structured to specifically indicate whether an incident involved incomplete inactivation, nor require laboratories to include “incomplete inactivation” in the description of the incident. As a result, officials cannot easily search their databases to identify such incidents once the information on the reporting forms is entered into the database. According to Select Agent Program officials, the current structure of the reporting forms could affect their understanding of the magnitude of the problem, and a more extensive analysis of the full report descriptions for all incidents in the database could identify additional incidents involving incomplete inactivation. According to the Centers for Disease Control and Prevention (CDC), the equine encephalitis viruses are mosquito-transmitted diseases that can cause severe inflammation of the brain (encephalitis) in horses and humans. Eastern equine encephalitis (EEE) most commonly occurs in the eastern United States and Canada while Venezuelan equine encephalitis (VEE) most commonly occurs in South and Central America but has spread to the United States. Although a rarely seen illness in humans, approximately 33 percent of individuals with EEE die from the disease and many survivors are left with significant brain damage; infected horses have variable death rates as high as 90 percent. VEE is the most infectious of the equine encephalitis viruses and the United States weaponized VEE as an offensive incapacitating agent before the termination of its biological weapons program. These viruses are highly infectious by the aerosol route and have caused more than 160 laboratory-acquired infections, according to the Biosafety in Microbiological and Biomedical Laboratories (BMBL) manual. Similar to the Select Agent Program, NIH has an incident reporting form and requires laboratories under its purview to report incidents involving recombinant pathogens. We identified four incidents involving incomplete inactivation of recombinant pathogens that occurred from 2003 through 2015, which were reported to NIH but were not provided to us, through a review of incident reporting forms (see table 4). NIH later confirmed that these four incidents did involve incomplete inactivation. For example, due to an equipment failure in 2014, researchers at an academic high- containment laboratory inadvertently moved viable samples of a recombinant pathogen thought to be inactivated outside of containment. The university reported the incident to NIH, but NIH officials did not initially identify this incident as resulting from incomplete inactivation. As with the Select Agent Program’s form, NIH’s reporting form for incidents involving recombinant pathogens is not structured to specifically indicate whether an incident involved incomplete inactivation, nor requires laboratories to include “incomplete inactivation” in the description of the incident, leading to difficulty in identifying such reports in its database. These examples demonstrate challenges the Select Agent Program and NIH have with identifying which incidents involve incomplete inactivation for the pathogens they regulate. Because the Select Agent Program and NIH cannot easily identify which incidents involve incomplete inactivation on reporting forms and within incident databases, they do not know the frequency or reason these incidents occur, making it difficult to develop guidance to help prevent future incidents. A CDC internal review of the Select Agent Program issued in 2015 noted the need to include subcategories of “release,” “loss,” and other additional fields on reporting forms to more consistently identify and categorize incidents moving forward. In addition, Standards for Internal Control in the Federal Government states that agencies are to employ control activities, such as the accurate recording of events, to help ensure that management’s directives are carried out and actions are taken to address risks. Our prior work on safety reporting systems has noted that report formats should allow for a sufficient description of events that align with analysis decisions, including the ability to effectively perform root cause analysis on high-priority issues. In addition, a 2016 report we issued on biological safety in high-containment laboratories highlighted the importance of analyzing all incident reports to identify potential trends. Officials from the Select Agent Program stated that they plan to revise their reporting forms in response to the 2015 internal CDC review mentioned above and issue new guidance associated with the new forms, thus allowing officials to search the database for new and more consistent information. However, as of April 2016, Select Agent Program officials had not yet determined what additional information to include on the forms. Moreover, as of May 2016, NIH officials told us that they did not plan to update their reporting form. Second, the total number of incidents involving incomplete inactivation in high-containment laboratories that occurred from 2003 through 2015 is unknown because federal incident reporting, in general, is required only for (1) incidents that involve select agents, which are reportable to the Select Agent Program; and (2) incidents that involve recombinant pathogens, which are reportable to NIH. Thus, incidents involving incomplete inactivation of pathogens that are neither select agents nor recombinant pathogens, such as West Nile virus, are generally not required to be reported to any federal agency (see fig. 2). Reporting is required for select agents because the Select Agent Program has determined that they have the potential to “pose a severe threat to public and agricultural health and safety.” However, nonselect agents also have the potential to cause disease if not properly inactivated. For example, during the course of our review, we found an incident involving the incomplete inactivation of Mycobacterium tuberculosis, a nonselect agent that causes the disease tuberculosis, in one laboratory. Because there are no federal reporting requirements for incidents involving pathogens that are neither select agents nor recombinant pathogens, only the laboratory in which the inactivation procedure failed was aware of the incident. Some experts from our meeting noted that it would be beneficial if all pathogens in high-containment received the same level of scrutiny and had the same biological safety controls in place when leaving high containment, whether the sample is a select agent or not. However, one expert also noted that when the Select Agent Program was created, its focus was more on the biological security risks associated with pathogens rather than biological safety, which may contribute to what appears to be an artificial distinction between select and nonselect agents for incident reporting. As a way to address the issue of incident reporting in a broader scope, we recommended in 2016 that federal high-containment laboratories report all incidents, whether they involve select agents or not, to senior agency officials. Third, the total number of incidents involving incomplete inactivation that occurred from 2003 through 2015 is also unknown because there is currently no clear and consistent definition of inactivation in guidance or regulations issued by the Select Agent Program, NIH (for oversight of recombinant pathogens), or the BMBL manual. As a result, researchers may not consistently define inactivation, which potentially affects how and when they report incidents involving incomplete inactivation. Experts at our meeting stated there is a need for a clear, consistent definition of inactivation across key federal guidance documents, with some experts noting that the lack of a consistent definition can make it difficult to understand when an incident occurs. The BMBL manual also emphasizes the need for clear definitions to avoid misuse and confusion of key terms used in research, but does not itself define inactivation. In addition, our past work has shown that the use of standardized definitions is key to ensuring that information is reported consistently. Officials from the Select Agent Program, NIH, and CDC agreed that there is a need for a clear and consistent definition of inactivation across guidance documents. Specifically, the Select Agent Program is in the process of revising the select agent regulations, which program officials told us will include a definition of inactivation; however, the program has received a number of comments from the public in response to these proposed changes and officials told us that further alterations will be made to the proposed rule before it is finalized and submitted. Officials from NIH, responsible for the oversight of recombinant pathogens, noted they released an update to the NIH guidelines in April 2016 and currently do not have any other planned updates. NIH and CDC are in the process of updating the BMBL manual and officials involved noted they did not yet know the extent to which inactivation would be covered in the next edition of the manual, but that they would consider any comments on how to improve the BMBL as they move forward in the drafting process. It is unclear to what extent the planned changes to the select agent regulations and the BMBL manual will provide a clear and consistent definition of inactivation. Officials from NIH responsible for recombinant pathogens and officials in charge of the BMBL manual noted that they would consider the results of the new select agent regulations to inform the changes made to their own documents, as they relate to inactivation. Without the ability to easily identify incidents involving incomplete inactivation on reporting forms, the Select Agent Program and NIH are unable to easily search their databases to know the frequency and causes of incidents related to the pathogens they regulate. In addition, without a clear and consistent definition of inactivation across key federal guidance, researchers may not know when to include incomplete inactivation in an incident report, potentially affecting the number of incidents reported to the Select Agent Program and NIH (for recombinant pathogens). Collectively, these issues prevent these agencies from knowing the extent to which incomplete inactivation occurs and whether these incidents are being properly identified, analyzed, and addressed. Not knowing the magnitude of the problem may inhibit their ability to achieve program missions of investigating any incidents in which noncompliance may have occurred. The 21 incidents involving incomplete inactivation from 2003 through 2015 that we identified occurred at different types of high-containment laboratories—specifically federal laboratories, academic institutions, and private companies. In addition, these incidents involved all methods of inactivation—including irradiation, chemical, and physical (e.g., heat) inactivation—and a variety of pathogens (see fig. 3). Our review identified some similarities in the 21 identified incidents involving incomplete inactivation, with just over half of the cases occurring at federal laboratories, over a third of incidents involving Bacillus anthracis, and about three-quarters of the incidents involving chemical inactivation. According to agency officials, none of the incidents involving incomplete inactivation identified in this report resulted in human infection, severe illness, or death. Because the total number of times inactivation is conducted in each laboratory is unknown, it is impossible to determine the overall risk of incomplete inactivation or the contribution of the pathogen, type of laboratory, or method of inactivation to the overall risk. Eight of the 21 identified incidents involving incomplete inactivation that occurred from 2003 through 2015 involved Bacillus anthracis. This finding reflects a theme heard during our expert meeting and interviews that Bacillus anthracis, especially in spore form, is one of the most difficult pathogens to inactivate. One high-profile incident occurred at DOD’s Life Sciences Division at Dugway Proving Ground (Dugway) in Utah over the course of 12 years, in which 575 shipments of incompletely inactivated Bacillus anthracis were sent to 194 laboratories and contractors around the world from 2004 through 2015 (see fig. 4). A DOD review of the incident, completed in December 2015, determined that there was insufficient evidence to establish a single failure as the proximate cause for the inadvertent shipment of incompletely inactivated Bacillus anthracis. However, the report stated that the equipment used to irradiate the samples experienced several malfunctions. A researcher at the facility noted that these malfunctions included a nonfunctioning turntable, a broken motor, and misplaced indicator strips that measure the amount of radiation being applied, which may have contributed to incomplete inactivation. In addition, the report stated that senior management at Dugway “allowed a culture of complacency to flourish at the facility, resulting in laboratory personnel who did not always follow rules, regulations, and procedures.” As a result of this incident, DOD currently has a working group looking into best practices for the inactivation of Bacillus anthracis by irradiation. About three-quarters (15 of 21) of identified incidents involving incomplete inactivation that occurred from 2003 through 2015 involved inactivation using only chemical methods; two of these occurred at CDC in 2014. For example, in June 2014, CDC researchers transferred samples of Bacillus anthracis thought to be inactivated from a high-containment laboratory to a lower safety level laboratory to test equipment used to detect pathogens. Up to 70 staff members at CDC were potentially exposed to viable samples. CDC determined that the overriding factor contributing to this incident was lack of a written plan approved by senior staff or scientific leadership to ensure that the research design was appropriate and met all laboratory safety requirements. Another incident at CDC involved Ebola virus samples, wherein inadequate safeguards did not minimize human error, resulting in a potential release in December 2014. Scientists inadvertently switched samples designated for live Ebola virus studies with samples intended for studies with inactivated material. As a result, the samples with viable Ebola virus, instead of the samples with inactivated Ebola virus, were transferred out of a BSL-4 laboratory to a laboratory with a lower safety level for additional analysis. While no one contracted Ebola virus in this instance, the consequences could have been dire for the personnel involved as there are currently no approved treatments or vaccines for this virus. According to the BMBL manual, there are limited treatment options for any pathogen that must be handled in a BSL-4 laboratory. About one-quarter (6 of 21) of identified incidents that occurred from 2003 through 2015 were related to issues with inactivation protocols—that is, a detailed plan for how inactivation will be carried out. Specifically, researchers used protocols from other laboratories without testing those protocols in their own laboratories, used flawed protocols, or did not verify the effectiveness of protocols they developed themselves. For example, in December 2010, a researcher at a private laboratory transferred samples of what was mistakenly thought to be inactivated Eastern equine encephalitis virus to another laboratory. The researcher had used a different laboratory’s protocol for chemical inactivation without verifying its effectiveness under the conditions in his own laboratory, resulting in incomplete inactivation of samples. In addition, following an incident at an academic institution, researchers identified flaws in their protocol. Specifically, they discovered that the amount of chemical in the protocol was not enough to inactivate the samples, and that the proportion of sample used to test for viability was not sufficient. Both of these factors contributed to incompletely inactivated samples being removed from a high-containment laboratory. Some experts from our meeting, as well as researchers we interviewed, confirmed that it is important to verify a protocol in-house before it is used. In addition, 4 of the 21 incidents that occurred from 2003 through 2015 occurred after researchers did not follow protocols that had previously been verified to work in their laboratories. Lastly, about one-quarter (5 of 21) of identified incidents that occurred from 2003 through 2015 involved equipment or other issues (such as mislabeling), and about one-quarter (5 of 21) of these incidents involved issues with viability testing—either the absence of viability testing or the removal of a sample before the viability test was complete. One incident involved both equipment and viability testing issues. Specifically, at one university, an equipment failure resulted in incomplete inactivation of samples, which were not tested for viability before removing them from containment. Researchers at the university used heat to inactivate Burkholderia pseudomallei (the bacterium that causes Whitmore’s Disease, a disease that primarily affects the lungs) without realizing that the heating block had not achieved the optimal temperature to ensure inactivation. As a result, samples that still contained viable pathogens were unknowingly removed from containment. Officials from the university told us that viability testing was not required before the samples were removed from containment because they had done the inactivation step “thousands of times” in the past, and past samples had always been nonviable. We identified some themes across these identified incidents, but in general, incidents involving incomplete inactivation occurred in all types of high-containment laboratories, involved a wide range of pathogens, and involved a variety of methods. Moreover, different contributing factors led to incomplete inactivation among the identified incidents, with multiple factors contributing to some incidents. Overall, no one type of laboratory, pathogen, inactivation method, or underlying cause was responsible for all of the identified incidents involving incomplete inactivation that occurred from 2003 through 2015. Several challenges affect the implementation of inactivation in high- containment laboratories including (1) gaps in the scientific knowledge of protocol development and implementation, (2) limited federal guidance for the development of inactivation protocols, (3) inconsistent implementation of safeguards to help ensure inactivation is properly conducted, and (4) varied documentation requirements for the shipment of inactivated material. Experts in our meeting stated that such challenges may affect laboratories’ ability to mitigate the risk of incidents involving incomplete inactivation. Insufficient scientific information exists to guide the development and implementation of inactivation protocols, which could result in incomplete inactivation, according to peer-reviewed literature and our group of experts. Moreover, a DOD report reviewing the Dugway incident stated that a contributing factor to the release of viable pathogens were gaps in scientific understanding of inactivation and viability testing. These scientific gaps include: Mechanisms of inactivation: It is important for researchers to understand the mechanism of inactivation, according to experts from our meeting, but this is not always clearly understood. For example, how some chemicals, such as iodine, achieve inactivation of pathogens is unknown, which may lead to confusion when developing inactivation protocols. Scaling up a protocol—e.g., inactivating a larger sample than what the protocol stipulates, with an equal increase in the amount of the inactivating agent—may not achieve inactivation of pathogens when using some inactivation methods but the reasons why this occurs are unknown. In addition, officials told us that researchers sometimes perform inactivation procedures using manufactured chemical kits, in which the chemical composition may be proprietary. According to experts we interviewed, it may be difficult for researchers to determine the mechanism of inactivation and the factors that may affect the effectiveness of such chemical kits (e.g., temperature or exposure time). Repair mechanisms: Inactivation of certain pathogens can be difficult because pathogens can sometimes reverse or repair the damage caused by inactivation processes, according to an expert from our meeting; however, the science as to how and to what extent repair occurs is unknown. For example, some peer-reviewed journal articles state that Bacillus anthracis may be able to repair itself following inactivation, but the extent and conditions of repair processes have not been determined. A DOD report on the Dugway incident stated that there is limited scientific research on the ability of spores to repair or heal themselves following irradiation. Kill curves: Kill curves are an important calculation used to determine the amount of exposure to an inactivating agent (e.g., an amount of chemical, exposure time, or radiation dose) necessary to render pathogens nonviable, according to a key textbook on inactivation. An expert we interviewed stated that gaps in the understanding of calculating kill curves can influence the development of inactivation protocols and may lead to an increased risk of incomplete inactivation. Specifically, there is not a clear understanding of how different factors may affect the calculation of kill curves. For example, using test tubes made of different types of material can affect the amount of inactivating agent (e.g., radiation or heat) needed, and the temperature at which irradiation is being performed can also influence the calculation of the kill curve. A DOD report stated that DOD routinely operated outside validated experimental data for the kill curve, irradiating samples with large numbers of pathogens without concurrently increasing the radiation dose necessary to achieve inactivation. Viability testing: Viability testing is a procedure to determine the extent to which viable pathogens remain in a sample after an inactivation process, according to experts and officials. However, the proportion of sample needed for viability testing is not well understood and may affect the ability of laboratories to determine if pathogens that have undergone inactivation are still viable. More specifically, the proportion of a sample used for testing varies greatly—anywhere from 1 to 50 percent, according to agency officials and documents—which affects the level of confidence about the effectiveness of inactivation procedures. In addition, experts we met with noted that it may not be possible to prove that a sample is 100 percent inactivated without testing 100 percent of the sample, which would leave no inactivated material for research purposes. Therefore, there will always be an element of uncertainty involved with inactivation of pathogens. In addition, many factors influence the ability for pathogens to grow— including length of time, the type of media the pathogen is grown in or on, and others—but how these factors affect pathogen growth are not always clearly understood. Gaps in the science of inactivation and viability testing led to ad hoc and sometimes iterative development of protocols among some laboratories, which could increase the risk of incomplete inactivation. For example, one senior Dugway official told us that they would put a sample in the irradiator until it received a dose of radiation commonly accepted to be sufficient to inactivate Bacillus anthracis, then take it out and determine whether it was inactivated by growing a portion of the sample and testing it. If viable Bacillus anthracis was found, they would irradiate it for additional time until the sample was deemed inactivated by the viability testing procedure. Multiple such failures of inactivation at Dugway did not initiate a review of inactivation or viability testing protocols until the shipment of viable pathogens was discovered in May 2015. A number of factors contribute to these scientific gaps, according to experts and officials we interviewed. For example, there is little funding solely dedicated to research on inactivation, making it difficult for laboratories to conduct research to address scientific gaps on this topic. In addition, experts from our meeting and officials from high-containment laboratories we visited pointed out that even when research on inactivation methods is conducted, publishing that research is sometimes challenging because inactivation methods may be part of a larger research question and thus not a priority for scientists or journals. Furthermore, some journals may not publish inactivation methods if there is no perceived impact of the research. In 2004, researchers reported in a journal that a manufactured chemical buffer inactivated certain pathogens and, subsequently, researchers in some high-containment laboratories used this buffer for inactivation. Several years later, other researchers discovered that this buffer was not always effective, finding that it did not inactivate Ebola virus in 67 percent of samples. We identified at least one high-containment laboratory that had a policy to use this chemical buffer for inactivation without testing for viability. GAO briefed Federal Select Agent Program officials about the inefficacy of the chemical buffer and in January 2016, the Federal Select Agent Program alerted laboratories that this method was not appropriate to inactivate select agents without proper validation of the method. One key theme discussed during our expert meeting was the need for more research and sharing of such information to overcome scientific gaps in inactivation and viability testing. Moreover, officials from the majority of federal agencies with high-containment laboratories that we interviewed stated that it would be beneficial to the scientific community to better coordinate and share scientific information on inactivation. The Federal Experts Security Advisory Panel—an interagency panel led by HHS and USDA to address policy issues relevant to the security of select agents—recommended in 2014 that a robust, federally-supported program of applied biological safety research be developed and maintained. According to HHS officials, this panel is a potential venue for coordinating research on inactivation and viability testing across high- containment laboratories, with inactivation as one element of the broader research agenda. USDA and other agency officials agreed that this panel could help coordinate research. Without coordination of research and actions taken to increase scientific information related to inactivation and viability testing across high-containment laboratories, there may continue to be gaps in scientific understanding of inactivation and viability testing, increasing the risk of incomplete inactivation. There is limited federal guidance for researchers on the development and validation of inactivation protocols. Major sources for technical guidance that researchers commonly use, such as the BMBL manual and NIH guidelines, as well as guidance from the Select Agent Program, provide little detailed information on development and validation of inactivation protocols. In lieu of guidance, we found that researchers in laboratories we visited often developed inactivation protocols at a laboratory level and that protocols sometimes varied within the same department, agency, or laboratory, which may increase the risk of incomplete inactivation. For example, according to DOD documents, at the time the Dugway incident was discovered, DOD was using different protocols for the inactivation of Bacillus anthracis spores by irradiation at each of its high-containment laboratories, as well as different viability testing protocols which likely varied in effectiveness. After protocols are developed, we found that researchers may or may not take steps to validate their efficacy. A validated method, as defined by the Select Agent Program for the purpose of inactivation, is a method that must be scientifically sound and produce consistent results each time it is used such that the expected result can be ensured. Due to limited guidance, high-containment laboratories we visited varied in their interpretation of what constitutes a validated method of inactivation, resulting in researchers applying differing levels of rigor to validation of inactivation protocols. For example, the BMBL manual and NIH guidelines do not provide a definition of validation or give examples of what constitutes validation of a protocol. Similarly, the select agent regulations are currently limited in their guidance on validation of inactivation protocols. In recent proposals to amend the select agent regulations, CDC and APHIS suggested changes to the select agent regulations that will require laboratories to use a validated protocol for inactivation of dangerous pathogens to prevent the release of viable pathogens; however, these suggested changes do not define how inactivation protocols are to be validated. An expert from our meeting and laboratory officials we interviewed identified concerns with the Select Agent Program’s criteria for what constitutes the validation of a protocol. In particular, an expert from our meeting suggested that some of the Select Agent Program’s accepted ways of validating methods are not adequately rigorous. For example, guidance from the Select Agent Program states that using a published method is sufficient. However, during our meeting, experts agreed that methods should be reproduced in each high- containment laboratory they will be used in to ensure consistent, reproducible results. Another key theme discussed during our expert meeting was the need for more comprehensive and consistent federal guidance on the development and validation of inactivation protocols. In addition, the Federal Expert Security Advisory Panel report recommended that institutional biosafety programs require validation of inactivation protocols, and our past work has also emphasized the importance of validation more generally. Without more comprehensive and consistent federal guidance on the development and validation of inactivation protocols, protocols will vary in their scientific soundness and effectiveness, increasing the risk of some protocols not always achieving inactivation. secondary verification steps, such as having a second individual observe a researcher performing the critical inactivation steps. As a result of incidents involving transfers of potentially viable pathogens in 2014, CDC implemented policies directing the use of a verification mechanism to ensure that critical inactivation steps were followed every time inactivation was performed. Other high-containment laboratories we visited had no verification mechanisms in place to ensure inactivation procedures were followed, potentially increasing the risk of incomplete inactivation. Periodic updates to protocols: According to a DOD report, laboratories should have subject matter experts periodically review and update laboratory protocols to ensure that they have the most up- to-date knowledge. In addition, Standards for Internal Control in the Federal Government states that agencies should accurately document internal control activities, such as reviews and updates of their policies. We found that the extent to which inactivation protocols were reviewed and updated to reflect emerging scientific research varied across laboratories. Some high-containment laboratories we visited had a process for reviewing all of their inactivation protocols on an annual basis while other laboratories did not. Periodically reviewing protocols ensures that inactivation protocols are updated to reflect emerging scientific research. One purpose for conducting inactivation is to create vaccines, which may use inactivated pathogens to stimulate a person’s immune system to produce immunity to the disease caused by that pathogen. However, incompletely inactivating the pathogen during the course of developing a vaccine can have serious consequences. For example, in 1955, incomplete inactivation of the poliovirus vaccine led to 40,000 cases of polio, left 51 children permanently paralyzed, and caused 5 deaths in the United States. In addition, in the 1970s and 1980s, incompletely inactivated vaccines caused an outbreak of foot-and- mouth disease among livestock in Western Europe. Foot-and-mouth disease is a highly contagious disease caused by a virus that infects cloven-hoofed animals, such as cattle, pigs, and sheep. Foot-and-mouth disease rarely infects humans but has a great potential for causing severe economic loss. Strong safety culture: Another key safeguard is having a strong safety culture that encourages safe practices, according to laboratory officials and experts we interviewed. We found that laboratories we visited varied in the extent to which they focused on safety. According to several agency officials and experts, identifying and mitigating potential safety issues in high-containment laboratories, including ones that may contribute to incidents involving incomplete inactivation, requires a cultural emphasis on safety. A 2015 report to CDC stated that leadership commitment toward safety at the agency was inconsistent and insufficient at multiple levels. CDC officials told us that they were taking steps to address issues related to safety culture, and a subsequent follow-up report stated that the CDC leadership was engaged and committed to promoting laboratory and research safety. Issues related to safety culture have also been identified at DOD. For example, officials at Dugway reported safety issues beyond incidents involving incomplete inactivation and, as noted, a DOD review from December 2015 identified issues related to safety culture at the facility. According to officials and experts, laboratory safety culture is enhanced by an open and transparent environment that encourages nonpunitive reporting of incidents and near-misses. We also found in past work that monitoring safety culture in laboratories is important so that managers remain aware of areas likely to lead to serious problems. Sharing lessons learned: The sharing of lessons learned as a result of post incident analysis can encourage the implementation of additional safeguards, according to experts. However, we found that laboratories varied in the extent to which they shared lessons learned. Several high-containment laboratories we interviewed internally shared lessons learned through newsletters, training updates, and e- mailed notices, whereas others lacked mechanisms for conveying this information. For example, several researchers told us that they share lessons learned within their respective high-containment laboratories, but there are not always mechanisms in place to share this type of information with others outside of their laboratories or agencies. Officials from the Select Agent Program acknowledged that there were a number of opportunities for the program to improve the sharing of lessons learned. We reported on the importance of sharing lessons learned in the past, recommending in March 2016 that departments with high-containment laboratories share lessons learned related to laboratory safety and security with laboratory personnel within their departments. It is important for researchers in high-containment laboratories to apply safeguards when developing and implementing inactivation protocols to mitigate the risk of incomplete inactivation and share information on lessons learned, according to experts from our meeting and agency documents. Without safeguards, officials risk not effectively implementing inactivation, potentially leading to incomplete inactivation. According to a CDC report, an overriding cause of the potential release of Ebola virus at CDC was inadequate safeguards to sufficiently minimize the possibility that human error could result in exposure to dangerous pathogens. According to experts, once an incident involving incomplete inactivation has taken place, documentation of the shipment of the inactivated pathogens can provide an important safeguard, if it is still viable and needs to be destroyed to prevent potential exposures or release. However, we found through our review of agency documents and interviews with agency officials that laboratories vary in their documentation requirements for inactivated pathogens. The BMBL manual currently provides no guidance for laboratories to create requirements to document the transfer of inactivated material. As a result, some laboratories document the shipment of inactivated material through a material transfer certificate or in laboratory logbooks, but others do not maintain any records on the movement of inactivated material. To illustrate, DOD did not immediately know all of the places that viable Bacillus anthracis had been sent following discovery of the Dugway incident. According to DOD, it took several months to identify all of the places that received viable Bacillus anthracis. Experts from our meeting stated that documenting shipments of inactivated material would be beneficial for facilitating the identification of laboratories that were inadvertently shipped viable material. In addition, Standards for Internal Control in the Federal Government states agencies are to employ control activities, such as the accurate recording of transactions and events, to help ensure actions are taken to address risks. Without guidance in the BMBL manual to document the shipment of inactivated pathogens, laboratories are at risk of being unable to locate pathogens in a timely manner, which is important if material thought to be inactivated is determined to still be viable. An expert noted that technologies in other fields may facilitate the documentation of the shipment of material, as is currently done in the food industry. The two agencies that comprise the Select Agent Program—CDC and APHIS—did not consistently refer incidents involving incomplete inactivation for further investigation and enforcement to the HHS Office of Inspector General (OIG) or APHIS’s Investigative and Enforcement Services for violations of select agent regulations. For example, the APHIS component of the program did not refer two 2014 incidents it was investigating at CDC laboratories involving incomplete inactivation, while the CDC component of the program referred a number of incidents that it investigated at federal, private, and academic laboratories. We found that it was unclear why some incidents were referred and enforced and not others. Table 5 shows referral and enforcement information related to the 21 identified incidents involving incomplete inactivation of select agents that occurred from 2003 through 2015. Select agents may only be transferred in a manner outlined in the select agent regulations and any release of select agents that causes occupational exposure or release outside of primary containment must be reported to the Select Agent Program. Failure to report the release of a select agent that is still viable because of incomplete inactivation, as well as transferring these agents without proper authorization, would be a violation of the select agent regulations. If the Select Agent Program identifies a possible violation of the select agent regulations, several types of enforcement actions may be taken, as follows: Administrative actions: The Select Agent Program can suspend or revoke a registered entity’s certification of registration, or deny an entity’s application to possess, use, or transfer select agents. Referrals to the HHS OIG or APHIS’s Investigative and Enforcement Services: The Select Agent Program may refer violations to HHS OIG or APHIS’s Investigative and Enforcement Services, which can levy civil monetary penalties (up to $250,000 for an individual for each violation and up to $500,000 for an entity for each violation); issue a Notice of Violation letter; or close the case. Referral to the FBI: The Select Agent Program can refer possible violations involving criminal negligence, criminal intent, or suspicious activity or person to the FBI for further investigation. Criminal enforcement may include imprisonment for up to 5 years, a fine, or both. According to an interagency memorandum of understanding regarding the Select Agent Program, CDC and APHIS should maintain consistency in the application and enforcement of the select agent regulations. In addition, as noted, Standards for Internal Control in the Federal Government states that agencies are to employ control activities, such as appropriately documenting transactions and internal controls. We found, however, that APHIS and CDC did not use the same set of criteria for referring violations for investigation by the HHS OIG or APHIS’s Investigative and Enforcement Services, nor clearly documented the bases for referring or not referring violations. Specifically, CDC has an internal written policy that lists criteria for referrals, such as knowingly or negligently transferring a select agent without prior authorization, whereas APHIS has no written policy and officials verbally described the general process to us. According to APHIS officials, they did not refer the two 2014 CDC laboratory incidents to Investigative and Enforcement Services because they did not believe the incidents were caused by any clear wrongdoing or persistent issues. However, APHIS did not provide any documentation on this decision. In other instances, the CDC component of the Select Agent Program referred incidents that appeared to us to be equally or less serious, yet this decision-making process was not clearly documented for all cases. In addition, it was unclear to us why the Select Agent Program took certain administrative actions, such as revoking or suspending an entity’s registration or requiring a corrective action plan, in response to some violations and not others. For example, the program required one private and two academic laboratories to develop corrective action plans following incidents involving incomplete inactivation but never required federal laboratories to develop corrective action plans following such incidents until the widespread Dugway incident in 2015, as shown in table 5. Moreover, a CDC internal review of the Select Agent Program from 2015 also identified issues related to the program’s enforcement of violations. In particular, the review stated that the program’s enforcement options were limited and difficult to scale to the range of findings on inspections and recommended that the program prioritize and strengthen enforcement actions to the highest risk violations. The Select Agent Program recently took some steps in an effort to increase consistency in the application and enforcement of select agent regulations. In responding to a draft of this report, the program provided a draft, joint CDC-APHIS document that provides some guidance on when to refer violations and options for enforcement actions. The program shared this draft document with registered entities for review and comment in June 2016. However, program officials did not provide us with a time frame or plan for finalizing and implementing the draft document. Moreover, it is not yet clear to what extent this document will improve the understanding and transparency of the program’s enforcement, and it does not define how or when decisions to refer violations and take enforcement actions will be documented. Without consistent criteria and documentation of decisions for referring violations and enforcing regulations related to incidents involving incomplete inactivation, the Select Agent Program cannot ensure that its regulatory approach to overseeing high-containment laboratories is applied consistently. These inconsistencies, in conjunction with our past work, also raise larger questions about the potential limitation of the Select Agent Program as a whole to effectively and independently oversee high-containment laboratories, both within HHS and across other federal agencies. Select Agent Program officials and an expert from our group noted that the Select Agent Program is independent in its oversight of HHS laboratories as it organizationally exists in a separate part of the department from the HHS agencies that have high-containment laboratories. However, as we have noted in our prior work, existing federal oversight of high-containment laboratories is fragmented and largely self-policing, raising questions about whether the government framework and oversight are adequate. Important research on dangerous pathogens depends on the ability of researchers to inactivate these pathogens so that research can proceed without posing an unnecessary risk to human and animal health. HHS, DOD, and other departments and agencies have taken some initial steps to address recent highly publicized incidents involving incomplete inactivation at federal laboratories, such as conducting additional research to improve inactivation methods for certain pathogens. Nevertheless, weaknesses remain in the federal government’s oversight of inactivation, as well as related research. In particular, without the ability to easily identify incidents involving incomplete inactivation on reporting forms and a clear and consistent definition of inactivation, HHS and USDA do not know the extent to which incomplete inactivation occurs and whether incidents are being properly identified, analyzed, and addressed. In addition, without coordination of research and actions taken to increase scientific information on inactivation and viability testing across high- containment laboratories, there may continue to be gaps in scientific understanding of inactivation, increasing the risk of incomplete inactivation. In light of the Federal Experts Security Advisory Panel’s recommendation to develop a research program on applied biological safety, HHS and USDA are positioned to coordinate research efforts on inactivation and viability testing across high-containment laboratories. Moreover, until HHS and USDA develop comprehensive and consistent guidance on the development, validation, and implementation of inactivation protocols—to include the application of safeguards— researchers will continue to apply differing levels of rigor, resulting in variability in the level of scientific soundness and effectiveness of inactivation protocols. Furthermore, in the absence of HHS guidance on documenting the shipment of inactivated pathogens, laboratories are at risk of being unable to locate these pathogens in a timely manner if they are later determined to be viable, as was seen in the Dugway case. Lastly, without consistent criteria and documentation across the Select Agent Program for referring violations and enforcing regulations, the Select Agent Program cannot ensure that its regulatory approach to overseeing high-containment laboratories is applied consistently— particularly between federal and nonfederal laboratories. This risk is of particular concern given the number of incidents at federal high- containment laboratories and raises questions about the appearance of a lack of independence in the regulation of these laboratories. Moreover, the challenges associated with inactivation when taken into consideration with our past work further illustrates the challenge posed by not having a single federal agency in charge of determining the aggregate risk associated with high-containment laboratories. In particular, our past findings on the risks posed by the proliferation of high-containment laboratories and the limited federal oversight of those laboratories that do not work with select agents highlights our concerns that existing oversight of high-containment laboratories is fragmented, at times duplicative, and relies on self-policing. To mitigate the risk to human and animal health due to incidents involving incomplete inactivation of dangerous pathogens used in high-containment laboratories, we are making the following six recommendations: To understand the extent to which incomplete inactivation occurs and whether incidents are being properly identified, analyzed, and addressed, we recommend that the Secretary of Health and Human Services direct CDC and NIH and that the Secretary of Agriculture direct APHIS to: develop clear definitions of inactivation for use within their respective guidance documents that are consistent across the Select Agent Program, NIH’s oversight of recombinant pathogens, and the Biosafety in Microbiological and Biomedical Laboratories manual; and revise reporting forms within their respective areas of oversight to help identify when incidents involving incomplete inactivation occur and analyze the information reported to help identify the causes of incomplete inactivation to mitigate the risk of future incidents. To increase scientific information on inactivation and viability testing, we recommend that the Secretaries of Health and Human Services and Agriculture coordinate research efforts and take actions to help close gaps in the science of inactivation and viability testing across high- containment laboratories. To help ensure that inactivation protocols are scientifically sound and are effectively implemented, we recommend that the Secretary of Health and Human Services direct CDC and NIH and that the Secretary of Agriculture direct APHIS to create comprehensive and consistent guidance for the development, validation, and implementation of inactivation protocols—to include the application of safeguards—across the Select Agent Program, NIH’s oversight of recombinant pathogens, and the Biosafety in Microbiological and Biomedical Laboratories manual. To help ensure that dangerous pathogens can be located in the event there is an incident involving incomplete inactivation, we recommend that the Secretary of Health and Human Services direct the Directors of CDC and NIH, when updating the Biosafety in Microbiological and Biomedical Laboratories manual, to include guidance on documenting the shipment of inactivated material. To help ensure more consistent enforcement for violations involving incomplete inactivation of select agents, we recommend that the Secretary of Health and Human Services direct CDC and that the Secretary of Agriculture direct APHIS to develop and implement consistent criteria and documentation requirements for referring violations to investigative entities and enforcing regulations related to incidents involving incomplete inactivation. We provided a draft of this report for review and comment to USDA, DOD, the Department of Homeland Security, HHS, the Department of the Interior, and the Environmental Protection Agency (EPA). Written responses from USDA, DOD, and HHS are reprinted in appendixes III through V. The Department of Homeland Security, the Department of the Interior, and EPA did not provide written comments. Of the two departments to which we made recommendations, both USDA and HHS agreed with all recommendations. In their written responses, they provided additional information about steps they are taking to improve biological safety and security in high-containment laboratories and to address our recommendations. For example, in October 2015, HHS created a biological safety and security council to coordinate and collaborate across the department. In addition, in response to our recommendation that HHS and USDA coordinate research efforts on the science of inactivation and viability testing, the departments stated that they are taking steps to develop a federally-supported program to improve laboratory biological safety, including examining current gaps related to inactivation. HHS and USDA also described other actions that are underway, including revising the select agent regulations, which they stated that they expect to finalize in October 2016, and developing guidance on enforcement of regulations. USDA, HHS, and DOD also provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees; the Secretaries of Agriculture, Defense, Health and Human Services, Homeland Security, and the Interior; the Administrator of EPA; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions concerning this report, please contact Timothy M. Persons, Chief Scientist, at (202) 512-6412 or personst@gao.gov or John Neumann, Director, Natural Resources and Environment, at (202) 512-3841 or neumannj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to the report are listed in appendix VI. This report evaluates (1) the extent to which incidents involving incomplete inactivation occurred from 2003 through 2015; (2) any challenges that may affect the implementation of inactivation in high- containment laboratories; and (3) the extent to which the Select Agent Program referred violations and enforced regulations related to incidents involving incomplete inactivation. To address our objectives, we reviewed relevant laws, regulations, and guidance, including the Biosafety in Microbiological and Biomedical Laboratories (BMBL) manual and guidance issued by the Select Agent Program. We also reviewed relevant documentation and interviewed officials from the federal departments that own and operate high- containment laboratories (biological safety level (BSL)-3, BSL-4, or both), as well as officials from some academic and private high-containment laboratories. The federal departments and their component agencies were the Department of Homeland Security; the Department of Defense (DOD) and its departments of the Army, Navy, and Air Force; Department of Energy and its National Nuclear Security Administration and Office of Science; Department of the Interior and its Fish and Wildlife Service and U.S. Geological Survey; Department of Veterans Affairs and its Veterans Health Administration; Department of Health and Human Services (HHS) and its components of Centers for Disease Control and Prevention (CDC), Food and Drug Administration, and the National Institutes of Health (NIH); United States Department of Agriculture (USDA) and its Animal and Plant Health Inspection Service (APHIS), Agricultural Research Service, and Food Safety and Inspection Service; and the United States Environmental Protection Agency (EPA). According to officials from the Department of Veterans Affairs, Interior’s Fish and Wildlife Service, and EPA, inactivation is not conducted in any of their high-containment laboratories so we excluded them from our scope. In addition, the Department of Energy’s Office of Science has not operated a high-containment laboratory since 2006, so we also excluded it from our scope. To obtain expert views on inactivation related to all of our objectives, we convened a meeting with 19 experts to discuss various issues surrounding inactivation of pathogens in high-containment laboratories. This meeting was held at the National Academy of Sciences (NAS) in February 2016, and staff at NAS assisted in identifying experts for this meeting. To identify the experts appropriate for the meeting, we worked iteratively with NAS staff to identify and review biographical information and relevant qualifications of experts, as well as factors such as representation from academia, industry, and federal government and expertise in a range of areas. The Board on Life Sciences of NAS solicited nominations for the expert panel from its extensive contacts in the biology and risk assessment community, academia, and organizations interested in biodefense. These contacts included current and former committee members, current and former members of NAS’s Board on Life Sciences, and select members of NAS. NAS initially identified a list of approximately 110 nominees. From this initial list, NAS selected experts based on their knowledge and expertise in pathogen and toxin inactivation and control, biological safety, risk assessment, legal requirements, standards development, incident reporting, epidemiology, and statistics, as well as their experience in academic, industry, and federal government sectors. In order to facilitate discussion among participants, NAS did not include any federal government employees from the Select Agent Program. Once we came to agreement with NAS on the final list of 19 experts for the meeting, these experts were evaluated for any conflicts of interest. A conflict of interest was considered to be any current financial or other interest that might conflict with the service of an individual because it (1) could impair objectivity and (2) could create an unfair competitive advantage for any person or organization. We discussed internally all potential conflicts. The 19 experts were determined to be free of conflicts of interest, and the group as a whole was judged to have no inappropriate biases. See appendix II for a list of the experts. The 2-day expert meeting was comprised of eight sessions covering a range of topics, such as incidents involving incomplete inactivation, scientific issues, and standards and guidance. We developed the session topics based on our researchable objectives and issues that were identified in our audit work, including our review of the peer-reviewed literature, analysis of agency documents, and interviews with agency and laboratory officials. The meeting was recorded and transcribed to ensure that we accurately captured the experts’ statements, and we reviewed and analyzed the transcripts as a source of evidence. Although the expert meeting was not designed to reach a formal consensus on the issues, a number of themes emerged from the group’s discussion to which there was general agreement. The group generally agreed on various issues and had several suggestions for how to address them. Following the meeting, we asked five of the experts to review our draft report to ensure expert comments and scientific concepts were appropriately captured. In selecting experts to review our draft, we first excluded all foreign individuals because the draft had not undergone a sensitivity review, as well as all federal officials because federal agencies had separate opportunities to comment on the draft during the agencies’ official comment period. Then, from the remaining experts, we selected experts to represent a range of expertise, including (1) one expert from industry, (2) one biological safety officer, (3) one policy expert, (4) one director of a high-containment laboratory, and (5) one individual with legal expertise. We incorporated comments from these experts into our final report. To evaluate the extent to which incidents involving incomplete inactivation occurred, we analyzed documentation on incidents reported to the CDC, APHIS, and NIH since 2003—when reporting of incidents involving the theft, loss, and release of select agents was first required under the Select Agent Program—through 2015—the most recent year for which data were available. We also interviewed officials from CDC and APHIS on the reporting of incidents to the Select Agent Program, and officials from NIH on the reporting of incidents involving recombinant pathogens. We took several steps to determine the reliability of the agencies’ incident databases, including interviewing agency officials and reviewing agency documents. We determined that the Select Agent Program incident database did not capture some cases of inactivation and was therefore not reliable on its own for establishing the number of incidents. We verified through interviews and documentation each incident identified in the Select Agent Program database as well as additional incidents that we identified. We conducted site visits for 7 of 10 high-containment laboratories and interviewed officials from 8 of the 10 high-containment laboratories at which incidents involving incomplete inactivation were originally reported to us by the Select Agent Program. We contacted officials from all 10 high-containment laboratories at which incidents involving incomplete inactivation were originally reported to us to arrange interviews; however, officials from one university and one private laboratory declined to be interviewed. We also interviewed officials from a nongeneralizable sample of 19 high-containment laboratories across the country that had not reported incidents, which were generally selected to represent a range of high-containment laboratories that work with human and animal pathogens and biological safety levels. The views of these officials are not generalizable to all laboratories, but they provide illustrative examples. We also interviewed officials from the Department of Labor’s Occupational Health and Safety Administration and HHS’s National Institute for Occupational Safety and Health to determine if they were aware of any incidents involving incomplete inactivation at high- containment laboratories. Because these agencies were not aware of any incidents involving incomplete inactivation and did not have any requirements related to the reporting of such incidents, we did not include them in our additional work. We compared information learned from interviews with laboratory and agency officials and from federal documents about the definition of inactivation and incidents involving incomplete inactivation with comments from our expert meeting, the BMBL manual, and our past work. Specifically, experts, the BMBL manual, and our past work emphasized the need for clear definitions to avoid confusion and maintain consistent reporting. In this respect, we considered the extent to which the definitions were consistent across the Select Agent Program, NIH’s oversight of recombinant pathogens, and the BMBL manual. We also analyzed reporting forms for identification of incidents involving incomplete inactivation from the Select Agent Program and NIH’s oversight of recombinant pathogens. To identify challenges that potentially affect the implementation of inactivation in high-containment laboratories, we reviewed relevant documents, such as inactivation protocols, biological safety manuals, laboratory newsletters, and articles from peer-reviewed literature. We also discussed challenges that exist and safeguards applied to address these challenges in our interviews with agency officials and researchers from high-containment laboratories and during our expert meeting. We also interviewed officials from the Department of Commerce’s National Institute of Standards and Technology to learn more about the process for developing scientific standards, and officials from CDC’s Laboratory Response Network to discuss standard protocols used by the network. We compared information we learned from our interviews with that of agency and laboratory officials and our review of federal documents on the development and validation of inactivation protocols and application of safeguards with key reports related to biological safety, expert comments, and our past work. In particular, we considered the extent to which current guidance was consistent with a Federal Expert Security Advisory Panel report that recommended that institutional biosafety programs require validation of all standard operating procedures for inactivation; our past work, which has emphasized the importance of validation more generally; and comments during our expert meeting, which emphasized the need to apply safeguards when developing and carrying out inactivation protocols. We also compared information from our interviews with laboratory officials and our review of related documents on the shipment of inactivated material with expert comments and internal controls from Standards for Internal Control in the Federal Government. To determine how the Select Agent Program referred violations and enforced regulations related to incidents involving incomplete inactivation in high-containment laboratories, we reviewed guidance, inspection reports, and other documents from the Select Agent Program, APHIS’s Investigative and Enforcement Services, and the USDA and HHS Offices of Inspector General (OIG). In our interviews with laboratory and Select Agent Program officials, we discussed steps the Select Agent Program has taken to refer violations and enforce regulations related to incidents involving incomplete inactivation. We also interviewed officials from the Investigative and Enforcement Services and HHS and USDA OIG to better understand their processes for enforcing the select agent regulations. We compared information we learned from our interviews with Select Agent Program officials and our review of program documents on the enforcement of violations of the select agent regulations with agency guidance on the program and internal controls from Standards for Internal Control in the Federal Government. In particular, an interagency memorandum of understanding on the Select Agent Program states that agencies should maintain consistency in the application and enforcement of select agent regulations, and Standards for Internal Control in the Federal Government states that agencies are to employ control activities, such as appropriately documenting transactions and internal controls. We considered the extent to which enforcement referrals and actions were consistent with these documents. We conducted this performance audit from July 2015 to August 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The names and affiliations of the experts who participated in the group discussion held February 11-12, 2016 in Washington, D.C., are as follows: Allan Bennett, Ph.D., General Project Manager, Public Health Robert Buchanan, Ph.D., Professor, University of Maryland Lawrence Blyn, Ph.D., Senior Director, Ibis Biosciences, Abbott Charles Gerba, Ph.D., Professor, University of Arizona Joshua Goldberg, J.D., Attorney, Goldberg Legal Services Jens-Peters Gregersen, Ph.D., GlaxoSmithKline Vaccines Gigi Kwik Gronvall, Ph.D., Senior Associate, University of Pittsburgh Molly Isbell, Ph.D., Director, Signature Science Richard Jaffe, Ph.D., Director, Medical Countermeasure Strategy & Requirements Division, Office of Policy and Planning, Assistant Secretary for Preparedness and Response, Department of Health and Human Services Barbara Johnson, Ph.D., Owner, Biosafety Biosecurity International Thomas Ksiazek, Ph.D., Professor, University of Texas Medical Jens Kuhn, Ph.D., Lead Virologist, Integrated Research Facility at Fort Detrick Justin Lessler, Ph.D., Associate Professor, Johns Hopkins University Benito Marinas, Ph.D., Professor, University of Illinois Brian O’Shea, Ph.D., Senior Biological Safety Officer, Battelle Karlene Roberts, Ph.D., Professor Emeritus, University of California, Berkeley Sophie Smither, Ph.D., Principal Scientist, Defence Science and Jeanette Thurston-Enriquez, Ph.D., Science Program and Analysis Officer, United States Department of Agriculture David Wunschel, Ph.D., Staff Scientist, Pacific Northwest National The comments of most of these experts represented the views of the experts themselves and not the agency, university, or company they are affiliated with. In addition to the individuals named above, Mary Denigan-Macauley (Assistant Director), Sushil Sharma (Assistant Director), Pille Anvelt, Amy Bowser, Caitlin Dardenne, Ashley Grant, Dani Greene, Ushna Ilyas, Lesley Rinner, Amber Sinclair, and Elizabeth Wood made key contributions to this report.

Summary: Several incidents involving the shipment of live pathogens, thought to be inactivated, have recently occurred, potentially exposing people to dangerous pathogens that cause infectious diseases, such as the bacterium that causes anthrax. GAO was asked to evaluate issues related to inactivation of pathogens in high-containment laboratories. This report examines (1) the extent to which incidents involving incomplete inactivation occurred from 2003 through 2015, (2) any challenges that may affect the implementation of inactivation in high-containment laboratories, and (3) the extent to which the Select Agent Program referred violations and enforced regulations related to incidents involving incomplete inactivation. GAO convened an expert meeting with the assistance of the National Academy of Sciences to discuss various issues surrounding inactivation. GAO also reviewed relevant laws, regulations, and guidance, and interviewed officials at laboratories that conduct inactivation. The total number of incidents involving incomplete inactivation—a process to destroy the hazardous effects of pathogens while retaining characteristics for future use—that occurred from 2003 through 2015 is unknown for several reasons. One key reason is that the Select Agent Program—operated by the Departments of Health and Human Services (HHS) and Agriculture (USDA) to oversee certain dangerous pathogens, known as select agents—does not require laboratories to identify such incidents on reporting forms. According to the program, 10 incidents occurred from 2003 through 2015. However, GAO identified an additional 11 incidents that the program did not initially identify. Because the program cannot easily identify incidents involving incomplete inactivation, it does not know the frequency or reason they occur, making it difficult to develop guidance to help mitigate future incidents. The 21 identified incidents involved a variety of pathogens and laboratories, as shown below. Several challenges affect the implementation of inactivation in high-containment laboratories, including gaps in scientific knowledge and limited guidance. For example, there is limited federal guidance for researchers on the development and validation of inactivation protocols. Validation helps ensure protocols are scientifically sound and produce consistent results. Due to limited guidance, laboratories varied in their interpretation of validated methods of inactivation, resulting in researchers applying differing levels of rigor. Without more comprehensive guidance, as called for by experts, protocols will vary in their scientific soundness, increasing the risk of incomplete inactivation. The Select Agent Program did not consistently refer incidents involving incomplete inactivation for further investigation and enforcement for violations of select agent regulations. For example, the program referred incidents involving incomplete inactivation at various laboratories, but did not refer two incidents in 2014 that occurred at HHS. A memorandum of understanding between HHS and USDA states that the program should handle incidents consistently. GAO found, however, that the program does not have a consistent, written set of criteria for handling incidents. Without such criteria, the program risks inconsistent enforcement of select agent regulations. This further highlights GAO’s previous finding that existing federal oversight of high-containment laboratories is fragmented and self-policing. GAO is making six recommendations to HHS and USDA to, among other things, improve the Select Agent Program’s oversight of inactivation by revising reporting forms, improving guidance for development and validation of inactivation protocols, and developing consistent criteria for enforcement of incidents involving incomplete inactivation. HHS and USDA agreed with GAO’s recommendations. or John Neumann at (202) 512-3841 or neumannj@gao.gov .