The Select Agent Program originated as part of the 1996 Anti-terrorism Act, which directed the secretary of the Department of Health and Human Services (HHS) to develop a comprehensive list of biologic agents and toxins capable of causing a severe threat to public health and safety, and required procedures for the transfer of the listed materials. In response to 9/11 and the anthrax attacks of 2001, Congress passed the Bioterrorism Preparedness Act of 2002, which significantly increased security and handling requirements for these select agents and established criminal penalties for non-compliance.

"Congress mandated the registration of all entities that possess, use, or transport select agents and toxins that could be used in a terrorist attack. These rules address the registration requirements and the biosafety and biosecurity requirements for the safe handling of these materials," says Charles Brokopp, director of the CDC's Select Agent Program.

The final Select Agent rules were published in response to public comments received regarding the interim final rules which were in effect since November 2003. The final rules harmonize the content and format of the CDC and APHIS regulations, and will make it easier for entities to comply. Under the rules, organizations possessing select agents and toxins must prepare a formal security plan, a biosafety plan, and an emergency response plan. Background checks on all personnel with access to agents must be performed by the FBI. Training of any individuals who have access to select agents and toxins must also be provided.

"The regulations don't spell out exactly how to meet the requirements; the entities are allowed some flexibility. An inventory of select agents, records of access to select agents, and records of all transfers of select agents must be maintained by the regulated entities," says Brokopp.

Changes and Updates

The CDC received more than 100 comments following the publication of the interim ruling. All comments and remarks were carefully considered and responded to in the preamble to the final rules. According to Brokopp, most of the suggestions were recognized as improvements and were incorporated.

"There was a lot of very good input from laboratories, universities, and the private sector, and we took those comments very seriously when drafting the final rules," he says.

Many of the clarifications in the final version of the rules were made to eliminate inconsistencies between the content and format of the CDC and APHIS regulations. The application, amendment, transfer, and reporting forms are now identical for both programs.

"Initially, entities would compare the CDC regulation to the APHIS regulation and wonder which one required the least amount of effort. Now, there is no practical difference between the two agency's regulations," says Brokopp.

Among other notable changes is a clause that gives organizations the option to choose a lead regulatory agency based on pre-existing relationships.

"Many veterinary and animal science laboratories work closely with the Department of Agriculture and so it was reasonable that they would want to choose APHIS as their lead regulatory agency. Many of the public health laboratories have a long-standing relationship with the CDC and therefore chose it as their lead agency," says Brokopp.

The final rules also includes limited exemptions for clinical and diagnostic labs that are on the forefront of identifying biologic agents from clinical specimens. The regulations do not require most clinical laboratories to register, however these laboratories must report the isolation or identification of select agents to CDC or APHIS.

"Basically, if a lab identifies one of these new organisms, they need to report it, secure it, and report any theft, loss, or release of it while it is in their possession," says Brokopp.

In addition to filing detailed incident response plans, select agent facilities are now required to conduct annual biosecurity and biosafety drills as part of the final rules.

A new provision was also included to allow for use of select agents in proficiency testing—the process of sending unlabeled samples to laboratories in order to test their ability to identify the agents. Proficiency testing is a way to test the laboratory's ability to properly handle and identify agents. The new rules require that CDC or APHIS be notified of any shipment of select agents as part of a proficiency testing program.

"We modified this process so it can still occur in a limited way without the entity knowing what agent has been sent. The organization that is sending the organism is now required to notify us seven days prior to sending samples," says Brokopp.

The secretary of HHS and the administrator of APHIS are authorized to approve transfers under a number of special conditions. In addition, the process was amended so that once a pathogen transfer is approved, it must occur within 30 days.

"We found that a number of people would request permission to transfer a select agent or toxin from one place to another. However, only after permission was granted would they choose to make the transfer. Sometimes the transfer would occur, and sometimes it wouldn't, or they would go back and try to make the transfer a year later with the same permit. It was clear that we needed to limit the time frame in which the transfer could occur after the permit was approved," says Brokopp.

One clause that was dropped from the interim rule required laboratory managers to document the exact time and date that each person entered and exited an area where they had access to select agents. The final rules do not require each person to document the time they exited areas where access to these agents occurred.

"We decided there was no need for this requirement, so it was removed," says Brokopp.

Biosecurity Today

There are approximately 400 organizations currently regulated by the Select Agent Program. Organizations that possess pathogens that are a threat to animals are regulated by APHIS. Entities that have human toxins report to the CDC.

"The vast majority of the entities in this country, about 91 percent, have agents that can cause significant disease in both humans and animals," says Brokopp. "These 'overlap' agents are of interest to both CDC and APHIS."

According to Brokopp, more than 80 percent of the regulated entities chose the CDC as their regulatory agency. Approximately 30 percent are state and local public health laboratories; another 30 percent are academic laboratories; while 18 percent are federal government labs; and 11 percent are commercial entities.

"There are several positive things that have occurred as a result of the Select Agent Programs at CDC and APHIS. We now have a very good idea of who possesses and uses select agents, and there is now a system for reporting any identification, theft, loss, or release of these agents on a national basis," says Brokopp.

Biosecurity Tomorrow

Laboratories that registered when the interim rule was published do not need to re-apply under the final regulations. Security risk assessments on persons who have access to select agents that have been issued by the Department of Justice under the interim rule will remain valid.

One new provision in the final rules that is attracting attention of facility operators is the requirement that the regulated entity conduct annual emergency biosecurity drills.

"Our point is that these biosafety and incident response plans are not static. They need to be used and refined. Most facilities working in this area are already participating in a variety of tabletop and field exercises that challenge their bioterrorism response capabilities. Many of these entities and laboratories can just expand these exercises to fulfill this requirement," says Brokopp.

A Web-based system is currently under development by CDC and APHIS that will assist entities with compliance with the Select Agent Program requirements. Registration, amendment, and reporting forms will be available online and can be submitted to the regulatory agencies via a secured Web-based system. This electronic system will help entities maintain their registration and facilitate the timely response to requests submitted to either the CDC or APHIS.

"Creating a Web-based system will greatly simplify the compliance process. In the future, when changes need to be made, the responsible official will be able to log on, update their information, and send it directly to the CDC or APHIS," says Brokopp.

By Johnathon Allen