About GPO   |   Newsroom/Media   |   Congressional Relations   |   Inspector General   |   Careers   |   Contact   |   askGPO   |   Help  
 
Home   |   Customers   |   Vendors   |   Libraries  

The Electronic Code of Federal Regulations (e-CFR) is a regularly updated, unofficial editorial compilation of CFR material and Federal Register amendments produced by the National Archives and Records Administration's Office of the Federal Register (OFR) and the Government Printing Office.

Parallel Table of Authorities and Rules for the Code of Federal Regulations and the United States Code
Text | PDF

Find, review, and submit comments on Federal rules that are open for comment and published in the Federal Register using Regulations.gov.

Purchase individual CFR titles from the U.S. Government Online Bookstore.

Find issues of the CFR (including issues prior to 1996) at a local Federal depository library.

[1]
 
 

Electronic Code of Federal Regulations

e-CFR Data is current as of September 19, 2014

Title 7Subtitle BChapter III → Part 331


Title 7: Agriculture


PART 331—POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS


Contents
§331.1   Definitions.
§331.2   Purpose and scope.
§331.3   PPQ select agents and toxins.
§331.4   [Reserved]
§331.5   Exemptions.
§331.6   [Reserved]
§331.7   Registration and related security risk assessments.
§331.8   Denial, revocation, or suspension of registration.
§331.9   Responsible official.
§331.10   Restricting access to select agents and toxins; security risk assessments.
§331.11   Security.
§331.12   Biocontainment.
§331.13   Restricted experiments.
§331.14   Incident response.
§331.15   Training.
§331.16   Transfers.
§331.17   Records.
§331.18   Inspections.
§331.19   Notification of theft, loss, or release.
§331.20   Administrative review.

Authority: 7 U.S.C. 8401; 7 CFR 2.22, 2.80, and 371.3.

Source: 70 FR 13278, Mar. 18, 2005, unless otherwise noted.

§331.1   Definitions.

Administrator. The Administrator, Animal and Plant Health Inspection Service, or any person authorized to act for the Administrator.

Animal and Plant Health Inspection Service (APHIS). The Animal and Plant Health Inspection Service of the U.S. Department of Agriculture.

Attorney General. The Attorney General of the United States or any person authorized to act for the Attorney General.

Biological agent. Any microorganism (including, but not limited to, bacteria, viruses, fungi, or protozoa), or infectious substance, or any naturally occurring, bioengineered, or synthesized component of any such microorganism or infectious substance, capable of causing:

(1) Death, disease, or other biological malfunction in a human, an animal, a plant, or another living organism;

(2) Deterioration of food, water, equipment, supplies, or material of any kind; or

(3) Deleterious alteration of the environment.

Centers for Disease Control and Prevention (CDC). The Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services.

Diagnosis. The analysis of specimens for the purpose of identifying or confirming the presence or characteristics of a select agent or toxin, provided that such analysis is directly related to protecting the public health or safety, animal health or animal products, or plant health or plant products.

Entity. Any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity.

HHS Secretary. The Secretary of the Department of Health and Human Services or his or her designee, unless otherwise specified.

HHS select agent and/or toxin. A biological agent or toxin listed in 42 CFR 73.3.

Import. To move into, or the act of movement into, the territorial limits of the United States.

Information security. Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide:

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Interstate. From one State into or through any other State, or within the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Permit. A written authorization by the Administrator to import or move interstate select agents or toxins, under conditions prescribed by the Administrator.

PPQ. The Plant Protection and Quarantine Programs of the Animal and Plant Health Inspection Service.

Recombinant nucleic acids. (1) Molecules that are constructed by joining nucleic acid molecules and that can replicate in a living cell; or

(2) Molecules that result from the replication of those described in paragraph (1) of this definition.

Responsible official. The individual designated by an entity with the authority and control to ensure compliance with the regulations in this part.

Security barrier. A physical structure that is designed to prevent entry by unauthorized persons.

Select agent and/or toxin. A biological agent or toxin listed in §331.3.

Specimen. Samples of material from humans, animals, plants, or the environment, or isolates or cultures from such samples, for diagnosis, verification, or proficiency testing.

State. Any of the several States of the United States, the Commonwealth of the Northern Mariana Islands, the Commonwealth of Puerto Rico, the District of Columbia, Guam, the Virgin Islands of the United States, or any other territory or possession of the United States.

Synthetic nucleic acids. (1) Molecules that are chemically or by other means synthesized or amplified, including those that are chemically or otherwise modified but can base pair with naturally occurring nucleic acid molecules (i.e., synthetic nucleic acids); or

(2) Molecules that result from the replication of those described in paragraph (1) of this definition.

Toxin. The toxic material or product of plants, animals, microorganisms (including, but not limited to, bacteria, viruses, fungi, or protozoa), or infectious substances, or a recombinant or synthesized molecule, whatever their origin and method of production, and includes:

(1) Any poisonous substance or biological product that may be engineered as a result of biotechnology produced by a living organism; or

(2) Any poisonous isomer or biological product, homolog, or derivative of such a substance.

United States. All of the States.

USDA. The U.S. Department of Agriculture.

Verification. The demonstration of obtaining established performance (e.g., accuracy, precision, and the analytical sensitivity and specificity) specifications for any procedure used for diagnosis.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61074, Oct. 5, 2012; 79 FR 26830 , May 12, 2014]

§331.2   Purpose and scope.

This part implements the provisions of the Agricultural Bioterrorism Protection Act of 2002 setting forth the requirements for possession, use, and transfer of select agents and toxins. The biological agents and toxins listed in this part have the potential to pose a severe threat to plant health or plant products.

§331.3   PPQ select agents and toxins.

(a) Except as provided in paragraphs (d) and (e) of this section, the Administrator has determined that the biological agents and toxins listed in this section have been determined to have the potential to pose a severe threat to plant health or to plant products.

(b) PPQ select agents and toxins:

Peronosclerospora philippinensis (Peronosclerospora sacchari);

Phoma glycinicola (formerly Pyrenochaeta glycines);

Ralstonia solanacearum;

Rathayibacter toxicus;

Sclerophthora rayssiae;

Synchytrium endobioticum;

Xanthomonas oryzae.

(c) Genetic elements, recombinant and/or synthetic nucleic acids, and recombinant and/or synthetic organisms:

(1) Nucleic acids that can produce infectious forms of any of the select agent viruses listed in paragraph (b) of this section.

(2) Recombinant and/or synthetic nucleic acids that encode for the functional forms of any toxin listed in paragraph (b) of this section if the nucleic acids:

(i) Can be expressed in vivo or in vitro; or

(ii) Are in a vector or recombinant host genome and can be expressed in vivo or in vitro.

(3) Select agents and toxins listed in paragraph (b) of this section that have been genetically modified.

(d) Select agents or toxins that meet any of the following criteria are excluded from the requirements of this part:

(1) Any select agent or toxin that is in its naturally occurring environment, provided that the agent or toxin has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source.

(2) Nonviable select agents or nonfunctional toxins.

(3) Any subspecies of Ralstonia solanacearum except race 3, biovar 2 and all subspecies of Sclerophthora rayssiae except var. zeae, provided that the individual or entity can identify that the agent is within the exclusion category.

(e) An attenuated strain of a select agent or a select toxin modified to be less potent or toxic may be excluded from the requirements of this part based upon a determination by the Administrator that the attenuated strain or modified toxin does not pose a severe threat to plant health or plant products.

(1) To apply for exclusion, an individual or entity must submit a written request and supporting scientific information. A written decision granting or denying the request will be issued. An exclusion will be effective upon notification to the applicant. Exclusions will be listed on the National Select Agent Registry Web site at http://www.selectagents.gov/.

(2) If an excluded attenuated strain or modified toxin is subjected to any manipulation that restores or enhances its virulence or toxic activity, the resulting select agent or toxin will be subject to the requirements of this part.

(f) Any select agent or toxin seized by a Federal law enforcement agency will be excluded from the requirements of this part during the period between seizure of the agent or toxin and the transfer or destruction of such agent or toxin provided that:

(1) As soon as practicable, the Federal law enforcement agency transfers the seized agent or toxin to an entity eligible to receive such agent or toxin or destroys the agent or toxin by a recognized sterilization or inactivation process.

(2) The Federal law enforcement agency safeguards and secures the seized agent or toxin against theft, loss, or release, and reports any theft, loss, or release of such agent or toxin.

(3) The Federal law enforcement agency reports the seizure of the select agent or toxin to APHIS or CDC. The seizure must be reported within 24 hours by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after seizure of the select agent or toxin. A copy of the completed form must be maintained for 3 years.

(4) The Federal law enforcement agency reports the final disposition of the select agent or toxin to APHIS or CDC by submission of APHIS/CDC Form 4. A copy of the completed form must be maintained for 3 years.

[70 FR 13278, Mar. 18, 2005, as amended at 73 FR 61331, Oct. 16, 2008; 77 FR 61075, Oct. 5, 2012; 79 FR 26830, May 12, 2014]

§331.4   [Reserved]

§331.5   Exemptions.

(a) Diagnostic laboratories and other entities that possess, use, or transfer a select agent or toxin that is contained in a specimen presented for diagnosis or verification will be exempt from the requirements of this part for such agent or toxin contained in the specimen, provided that:

(1) Unless directed otherwise by the Administrator, within 7 calendar days after identification, the agent or toxin is transferred in accordance with §331.16 or destroyed on-site by a recognized sterilization or inactivation process;

(2) The agent or toxin is secured against theft, loss, or release during the period between identification of the agent or toxin and transfer or destruction of such agent or toxin, and any theft, loss, or release of such agent or toxin is reported; and

(3) The identification of the agent or toxin is immediately reported to APHIS or CDC by telephone, facsimile, or e-mail. This report must be followed by submission of APHIS/CDC Form 4 within 7 calendar days after identification. Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas. A copy of APHIS/CDC Form 4 must be maintained for 3 years.

(b) In addition to the exemption provided in paragraph (a) of this section, the Administrator may grant a specific exemption upon a showing of good cause and upon his or her determination that such exemption is consistent with protecting plant health or plant products. An individual or entity may request in writing an exemption from the requirements of this part. If granted, such exemptions are valid for a maximum of 3 years; thereafter, an individual or entity must request a new exemption. If a request for exemption is denied, an individual or entity may request reconsideration in writing to the Administrator. The request for reconsideration must state all of the facts and reasons upon which the individual or entity relies to show that the exemption was wrongfully denied. The Administrator will grant or deny the request for reconsideration as promptly as circumstances allow and will state, in writing, the reasons for the decision.

§331.6   [Reserved]

§331.7   Registration and related security risk assessments.

(a) Unless exempted under §331.5, an individual or entity shall not possess, use, or transfer any select agent or toxin without a certificate of registration issued by the Administrator.

(b) As a condition of registration, each entity must designate an individual to be its responsible official. While most registrants are likely to be entities, in the event that an individual applies for and is granted a certificate of registration, the individual will be considered the responsible official.

(c)(1) As a condition of registration, the following must be approved by the Administrator or the HHS Secretary based on a security risk assessment by the Attorney General:

(i) The individual or entity;

(ii) The responsible official; and

(iii) Unless otherwise exempted under this section, any individual who owns or controls the entity.

(2) Federal, State, or local governmental agencies, including public accredited academic institutions, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions:1

1These conditions may apply to more than one individual.

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

(5) To obtain a security risk assessment, an individual or entity must submit the information necessary to conduct a security risk assessment to the Attorney General.

(d) To apply for a certificate of registration for only PPQ select agents or toxins, or for PPQ and VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS. To apply for a certificate of registration for overlap select agents or toxins, overlap select agents or toxins and any combination of PPQ or VS select agents or toxins, or HHS select agents or toxins and any combination of PPQ or VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS or CDC, but not both.

(e) Prior to the issuance of a certificate of registration, the responsible official must promptly provide notification of any changes to the application for registration by submitting the relevant page(s) of the registration application.

(f) The issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(g) A certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

(h) A certificate of registration may be amended to reflect changes in circumstances (e.g., replacement of the responsible official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins).

(1) Prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.2

2Depending on the change, a security risk assessment by the Attorney General may also be required (e.g., replacement of the responsible official, changes in ownership or control of the entity, new researchers or graduate students, etc.).

(2) The responsible official will be notified in writing if an application to amend a certificate of registration has been approved. Approval of an amendment may be contingent upon an inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(3) No change may be made without such approval.

(i) An entity must immediately notify APHIS or CDC if it loses the services of its responsible official. In the event that an entity loses the services of its responsible official, an entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of this part.

(j) A certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered.

(k) A certificate of registration will be valid for a maximum of 3 years.

§331.8   Denial, revocation, or suspension of registration.

(a) An application may be denied or a certificate of registration revoked or suspended if:

(1) The individual or entity, the responsible official, or an individual who owns or controls the entity is within any of the categories described in 18 U.S.C. 175b;

(2) The individual or entity, the responsible official, or an individual who owns or controls the entity is reasonably suspected by any Federal law enforcement or intelligence agency of:

(i) Committing a crime set forth in 18 U.S.C. 2332b(g)(5); or

(ii) Knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or

(iii) Being an agent of a foreign power as defined in 50 U.S.C. 1801;

(3) The individual or entity does not meet the requirements of this part;3 or

3If registration is denied for this reason, we may provide technical assistance and guidance.

(4) It is determined that such action is necessary to protect plant health or plant products.

(b) Upon revocation or suspension of a certificate of registration, the individual or entity must:

(1) Immediately stop all use of each select agent or toxin covered by the revocation or suspension order;

(2) Immediately safeguard and secure each select agent or toxin covered by the revocation or suspension order from theft, loss, or release; and

(3) Comply with all disposition instructions issued by the Administrator for each select agent or toxin covered by the revocation or suspension.

(c) Denial of an application for registration and revocation or suspension of registration may be appealed under §331.20. However, any denial of an application for registration or revocation or suspension of a certificate of registration will remain in effect until a final agency decision has been rendered.

§331.9   Responsible official.

(a) An individual or entity required to register under this part must designate an individual to be the responsible official. The responsible official must:

(1) Be approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General;

(2) Be familiar with the requirements of this part;

(3) Have authority and responsibility to act on behalf of the entity;

(4) Ensure compliance with the requirements of this part;

(5) Have a physical (and not merely a telephonic or audio/visual) presence at the registered entity to ensure that the entity is in compliance with the select agent regulations and be able to respond in a timely manner to onsite incidents involving select agents and toxins in accordance with the entity's incident response plan; and

(6) Ensure that annual inspections are conducted of each laboratory where select agents or toxins are stored or used in order to ensure compliance with the requirements of this part. The results of each inspection must be documented, and any deficiencies identified during an inspection must be corrected.

(b) An entity may designate one or more individuals to serve as an alternate responsible official who acts for the responsible official in his/her absence. These individuals must have the authority and control to ensure compliance with the regulations when acting as the responsible official.

(c) The responsible official must report the identification and final disposition of any select agent or toxin contained in a specimen for diagnosis or verification.

(1) The identification of the select agent or toxin must be immediately reported by telephone, facsimile, or e-mail. The final disposition of the agent or toxin must be reported by submission of APHIS/CDC Form 4 within 7 calendar days after identification. A copy of the completed form must be maintained for 3 years.

(2) Less stringent reporting may be required during agricultural emergencies or outbreaks, or in endemic areas.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61075, Oct. 5, 2012]

§331.10   Restricting access to select agents and toxins; security risk assessments.

(a) An individual or entity required to register under this part may not provide an individual access to a select agent or toxin, and an individual may not access a select agent or toxin, unless the individual is approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General.

(b) An individual will be deemed to have access at any point in time if the individual has possession of a select agent or toxin (e.g., carries, uses, or manipulates) or the ability to gain possession of a select agent or toxin.

(c) Each individual with access to select agents or toxins must have the appropriate education, training, and/or experience to handle or use such agents or toxins.

(d) To apply for access approval, each individual must submit the information necessary to conduct a security risk assessment to the Attorney General.

(e) A person with valid approval from the HHS Secretary or Administrator to have access to select agents or toxins may request, through his or her Responsible Official, that the HHS Secretary or Administrator provide their approved access status to another registered individual or entity for a specified period of time.

(f) An individual's security risk assessment may be expedited upon written request by the responsible official and a showing of good cause (e.g., agricultural emergencies, national security, or a short-term visit by a prominent researcher). A written decision granting or denying the request will be issued.

(g) An individual's access approval may be denied, limited, or revoked if:

(1) The individual is within any of the categories described in 18 U.S.C. 175b;

(2) The individual is reasonably suspected by any Federal law enforcement or intelligence agency of committing a crime set forth in 18 U.S.C. 2332b(g)(5); knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence; or being an agent of a foreign power as defined in 50 U.S.C. 1801; or

(3) It is determined that such action is necessary to protect plant health or plant products.

(h) An individual may appeal the Administrator's decision to deny, limit, or revoke access approval under §331.20.

(i) Access approval is valid for a maximum of 3 years.

(j) The responsible official must immediately notify APHIS or CDC when an individual's access to select agents or toxins is terminated by the entity and the reasons therefore.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61075, Oct. 5, 2012]

§331.11   Security.

(a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release.

(b) The security plan must be designed according to a site-specific risk assessment and must provide graded protection in accordance with the risk of the select agent or toxin, given its intended use. A current security plan must be submitted for initial registration, renewal of registration, or when requested.

(c) The security plan must:

(1) Describe procedures for physical security, inventory control, and information systems control;

(2) Contain provisions for the control of access to select agents and toxins, including the safeguarding of animals (including arthropods) or plants intentionally or accidentally exposed to or infected with a select agent, against unauthorized access, theft, loss or release.

(3) Contain provisions for routine cleaning, maintenance, and repairs;

(4) Establish procedures for removing unauthorized or suspicious persons;

(5) Describe procedures for addressing loss or compromise of keys, passwords, combinations, etc. and protocols for changing access numbers or locks following staff changes;

(6) Contain procedures for reporting unauthorized or suspicious persons or activities, loss or theft of select agents or toxins, release of select agents or toxins, or alteration of inventory records;

(7) Contain provisions for ensuring that all individuals with access approval from the Administrator or the HHS Secretary understand and comply with the security procedures;

(8) Describe procedures for how the Responsible Official will be informed of suspicious activity that may be criminal in nature and related to the entity, its personnel, or its select agents or toxins; and describe procedures for how the entity will notify the appropriate Federal, State, or local law enforcement agencies of such activity.

(9) Contain provisions for information security that:

(i) Ensure that all external connections to systems which manage security for the registered space are isolated or have controls that permit only authorized and authenticated users;

(ii) Ensure that authorized and authenticated users are only granted access to select agent and toxin related information, files, equipment (e.g., servers or mass storage devices), and applications as necessary to fulfill their roles and responsibilities, and that access is modified when the user's roles and responsibilities change or when their access to select agents and toxins is suspended or revoked;

(iii) Ensure that controls are in place that are designed to prevent malicious code (such as, but not limited to, computer viruses, worms, spyware) from compromising the confidentiality, integrity, or availability of information systems which manage access to spaces registered under this part or records as specified in §331.17;

(iv) Establish a robust configuration management practice for information systems to include regular patching and updates made to operating systems and individual applications; and

(v) Establish procedures that provide backup security measures in the event that access control systems, surveillance devices, and/or systems that manage the requirements of §331.17 are rendered inoperable.

(10) Contain provisions and policies for shipping, receiving, and storage of select agents and toxins, including documented procedures for receiving, monitoring, and shipping of all select agents and toxins. These provisions must provide that an entity will properly secure containers on site and have a written contingency plan for unexpected shipments.

(d) An individual or entity must adhere to the following security requirements or implement measures to achieve an equivalent or greater level of security:

(1) Allow access only to individuals with access approval from the Administrator or the HHS Secretary;

(2) Allow individuals not approved for access by the Administrator or the HHS Secretary to conduct routine cleaning, maintenance, repairs, and other activities not related to select agents or toxins only when continuously escorted by an approved individual if the potential to access to select agents or toxins exists;

(3) Provide for the control of select agents and toxins by requiring freezers, refrigerators, cabinets, and other containers where select agents or toxins are stored to be secured against unauthorized access (e.g., card access system, lock boxes);

(4) Inspect all suspicious packages before they are brought into or removed from an area where select agents or toxins are used or stored;

(5) Establish a protocol for intra-entity transfers under the supervision of an individual with access approval from the Administrator or the HHS Secretary, including chain-of-custody documents and provisions for safeguarding against theft, loss, or release; and

(6) Require that individuals with access approval from the Administrator or the HHS Secretary refrain from sharing with any other person their unique means of accessing a select agent or toxin (e.g., keycards or passwords);

(7) Require that individuals with access approval from the Administrator or the HHS Secretary immediately report any of the following to the responsible official:

(i) Any loss or compromise of keys, passwords, combinations, etc.;

(ii) Any suspicious persons or activities;

(iii) Any loss or theft of select agents or toxins;

(iv) Any release of a select agent or toxin; and

(v) Any sign that inventory or use records for select agents or toxins have been altered or otherwise compromised; and

(8) Separate areas where select agents and toxins are stored or used from the public areas of the building.

(e) Entities must conduct complete inventory audits of all affected select agents and toxins in long-term storage when any of the following occur:

(1) Upon the physical relocation of a collection or inventory of select agents or toxins for those select agents or toxins in the collection or inventory;

(2) Upon the departure or arrival of a principal investigator for those select agents and toxins under the control of that principal investigator; or

(3) In the event of a theft or loss of a select agent or toxin, all select agents and toxins under the control of that principal investigator.

(f) [Reserved]

(g) In developing a security plan, an individual or entity should consider the document entitled, “Security Guidance for Select Agent or Toxin Facilities.” This document is available on the National Select Agent Registry at http://www.selectagents.gov/.

(h) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61075, Oct. 5, 2012; 79 FR 26830, May 12, 2014]

§331.12   Biocontainment.

(a) An individual or entity required to register under this part must develop and implement a written biocontainment plan that is commensurate with the risk of the select agent or toxin, given its intended use.4 The biocontainment plan must contain sufficient information and documentation to describe the containment procedures for the select agent or toxin, including any animals (including anthropods) or plants intentionally or accidentally exposed to or infected with a select agent.

4Technical assistance and guidance may be obtained by contacting APHIS.

(b) The biocontainment procedures must be sufficient to contain the select agent or toxin (e.g., physical structure and features of the entity, and operational and procedural safeguards).

(c) In developing a biocontainment plan, an individual or entity should consider the following:

(1) “Containment Facilities and Safeguards for Exotic Plant Pathogens and Pests” (Robert P. Kahn and S.B. Mathur eds., 1999); and

(2) “A Practical Guide to Containment: Greenhouse Research with Transgenic Plants and Microbes” (Patricia L. Traynor ed., 2001).

(d) [Reserved]

(e) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61076, Oct. 5, 2012; 79 FR 26830, May 12, 2014]

§331.13   Restricted experiments.

(a) An individual or entity may not conduct or possess products resulting from the following experiments unless approved by and conducted in accordance with the conditions prescribed by the Administrator:

(1) Experiments that involve the deliberate transfer of, or selection for, a drug or chemical resistance trait to select agents that are not known to acquire the trait naturally, if such acquisition could compromise the control of disease agents in humans, veterinary medicine, or agriculture.

(2) Experiments involving the deliberate formation of synthetic or recombinant nucleic acids containing genes for the biosynthesis of select toxins lethal for vertebrates at an LD[50]<100 ng/kg body weight.

(b) The Administrator may revoke approval to conduct any of the experiments in paragraph (a) of this section, or revoke or suspend a certificate of registration, if the individual or entity fails to comply with the requirements of this part.

(c) To apply for approval to conduct any of the experiments in paragraph (a) of this section, an individual or entity must submit a written request and supporting scientific information to the Administrator. A written decision granting or denying the request will be issued.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61076, Oct. 5, 2012; 79 FR 26830, May 12, 2014]

§331.14   Incident response.5

5Nothing in this section is meant to supersede or preempt incident response requirements imposed by other statutes or regulations.

(a) An individual or entity required to register under this part must develop and implement a written incident response plan6 based upon a site specific risk assessment. The incident response plan must be coordinated with any entity-wide plans, kept in the workplace, and available to employees for review.

6Technical assistance and guidance may be obtained by contacting APHIS.

(b) The incident response plan must fully describe the entity's response procedures for the theft, loss, or release of a select agent or toxin; inventory discrepancies; security breaches (including information systems); severe weather and other natural disasters; workplace violence; bomb threats and suspicious packages; and emergencies such as fire, gas leak, explosion, power outage, and other natural and man-made events.

(c) The response procedures must account for hazards associated with the select agent or toxin and appropriate actions to contain such select agent or toxin, including any animals (including arthropods) or plants intentionally or accidentally exposed to or infected with a select agent.

(d) The incident response plan must also contain the following information:

(1) The name and contact information (e.g., home and work) for the individual or entity (e.g., responsible official, alternate responsible official(s), biosafety officer, etc.);

(2) The name and contact information for the building owner and/or manager, where applicable;

(3) The name and contact information for tenant offices, where applicable;

(4) The name and contact information for the physical security official for the building, where applicable;

(5) Personnel roles and lines of authority and communication;

(6) Planning and coordination with local emergency responders;

(7) Procedures to be followed by employees performing rescue or medical duties;

(8) Emergency medical treatment and first aid;

(9) A list of personal protective and emergency equipment, and their locations;

(10) Site security and control;

(11) Procedures for emergency evacuation, including type of evacuation, exit route assignments, safe distances, and places of refuge; and

(12) Decontamination procedures.

(e) [Reserved]

(f) The plan must be reviewed annually and revised as necessary. Drills or exercises must be conducted at least annually to test and evaluate the effectiveness of the plan. The plan must be reviewed and revised, as necessary, after any drill or exercise and after any incident.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61076, Oct. 5, 2012]

§331.15   Training.

(a) An individual or entity required to register under this part must provide information and training on biocontainment, biosafety, security (including security awareness), and incident response to:

(1) Each individual with access approval from the HHS Secretary or Administrator before that individual has such access to select agents and toxins. The training must address the particular needs of the individual, the work they will do, and the risks posed by the select agents or toxins; and

(2) Each individual not approved for access to select agents and toxins by the HHS Secretary or Administrator before that individual enters areas where select agents or toxins are handled or stored (e.g., laboratories, growth chambers, animal rooms, greenhouses, storage areas, shipping/receiving areas, production facilities, etc.). Training for escorted personnel must be based on the risk associated with accessing areas where select agents and toxins are used and/or stored.

(b) [Reserved]

(c) Refresher training must be provided annually for individuals with access approval from the HHS Secretary or Administrator or at such time as the registered individual or entity significantly amends its security, incident response, or biocontainment plans.

(d) The responsible official must ensure a record of the training provided to each individual with access to select agents and toxins and each escorted individual (e.g., laboratory workers, visitors, etc.) is maintained. The record must include the name of the individual, the date of the training, a description of the training provided, and the means used to verify that the employee understood the training.

[77 FR 61076, Oct. 5, 2012]

§331.16   Transfers.

(a) Except as provided in paragraph (c) of this section, a select agent or toxin may only be transferred to an individual or entity registered to possess, use, or transfer that agent or toxin. A select agent or toxin may only be transferred under the conditions of this section and must be authorized by APHIS or CDC prior to the transfer.7

7The requirements of this section do not apply to transfers within a registered entity (i.e., the sender and the recipient are covered by the same certificate of registration).

(b) In addition to any permit required under part 330 of this chapter, a transfer may be authorized if:

(1) The sender:

(i) Has at the time of transfer a certificate of registration that covers the particular select agent or toxin to be transferred and meets all the requirements of this part;

(ii) Meets the exemption requirements for the particular select agent or toxin to be transferred; or

(iii) Is transferring the select agent or toxin from outside of the United States and meets all import requirements.

(2) At the time of transfer, the recipient has a certificate of registration that includes the particular select agent or toxin to be transferred and meets all of the requirements of this part.

(c) On a case-by-case basis, the Administrator may authorize a transfer of a select agent or toxin not otherwise eligible for transfer under this part under conditions prescribed by the Administrator.

(d) To obtain authorization for a transfer, APHIS/CDC Form 2 must be submitted.

(e) After authorization is provided by APHIS or CDC, the packaging of the select agent(s) and toxin(s) is performed by an individual approved by the HHS Secretary or Administrator to have access to select agents and toxins and is in compliance with all applicable laws concerning packaging.

(f) The sender must comply with all applicable laws governing shipping.

(g) Transportation in commerce starts when the select agent(s) or toxin(s) are packaged for shipment and ready for receipt by a courier transporting select agent(s) or toxin(s) and ends when the package is received by the intended recipient who is an individual approved by the HHS Secretary or Administrator to have access to select agents and toxins, following a security risk assessment by the Attorney General.

(h) The recipient must submit a completed APHIS/CDC Form 2 within 2 business days of receipt of a select agent or toxin.

(i) The recipient must immediately notify APHIS or CDC if the select agent or toxin has not been received within 48 hours after the expected delivery time or if the package containing the select agent or toxin has been damaged to the extent that a release of the select agent or toxin may have occurred.

(j) An authorization for a transfer shall be valid only for 30 calendar days after issuance, except that such an authorization becomes immediately null and void if any facts supporting the authorization change (e.g., change in the certificate of registration for the sender or recipient, change in the application for transfer).

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61077, Oct. 5, 2012]

§331.17   Records.

(a) An individual or entity required to register under this part must maintain complete records relating to the activities covered by this part. Such records must include:

(1) An accurate, current inventory for each select agent (including viral genetic elements, recombinant and/or synthetic nucleic acids, and organisms containing recombinant and/or synthetic nucleic acids) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials), including:

(i) The name and characteristics (e.g., strain designation, GenBank Accession number, etc.);

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) Where stored (e.g., building, room, and freezer);

(iv) When moved from storage and by whom and when returned to storage and by whom;

(v) The select agent used and purpose of use;

(vi) Records created under §331.16 (Transfers);

(vii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the select agent, the quantity transferred, the date of transfer, the sender, and the recipient; and

(viii) Records created under §331.19 (Notification of theft, loss, or release);

(2) An accurate, current accounting of any animals or plants intentionally or accidentally exposed to or infected with a select agent (including number and species, location, and appropriate disposition);

(3) An accurate, current inventory for each toxin held, including:

(i) The name and characteristics;

(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;

(iii) The initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.);

(iv) The toxin used and purpose of use, quantity, date(s) of the use and by whom;

(v) Where stored (e.g., building, room, and freezer);

(vi) When moved from storage and by whom and when returned to storage and by whom, including quantity amount;

(vii) Records created under §331.16 (Transfers);

(viii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the toxin, the quantity transferred, the date of transfer, the sender, and the recipient;

(ix) Records created under §331.19 (Notification of theft, loss, or release);

(x) If destroyed, the quantity of toxin destroyed, the date of such action, and by whom.

(4) A current list of all individuals that have been granted access approval by the Administrator or the HHS Secretary;

(5) Information about all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), and the date and time of entry;

(6) Accurate, current records created under §331.9(c) (Responsible official), §331.11 (Security), §331.12 (Biocontainment), §331.14 (Incident response), and §331.15 (Training); and

(7) A written explanation of any discrepancies.

(b) The individual or entity must implement a system to ensure that all records and databases created under this part are accurate, have controlled access, and can be verified for authenticity.

(c) All records created under this part must be maintained for 3 years and promptly produced upon request.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61077, Oct. 5, 2012]

§331.18   Inspections.

(a) Without prior notification, APHIS must be allowed to inspect any site at which activities regulated under this part are conducted and must be allowed to inspect and copy any records relating to the activities covered by this part.

(b) Prior to issuing a certificate of registration to an individual or entity, APHIS may inspect and evaluate their premises and records to ensure compliance with this part.

§331.19   Notification of theft, loss, or release.

(a) An individual or entity must immediately notify APHIS or CDC upon discovery of the theft or loss of a select agent or toxin. Thefts or losses must be reported even if the select agent or toxin is subsequently recovered or the responsible parties are identified.

(1) The theft or loss of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity stolen or lost;

(iii) An estimate of the time during which the theft or loss occurred;

(iv) The location (building, room) from which the theft or loss occurred; and

(v) The list of Federal, State, or local law enforcement agencies to which the individual or entity reported, or intends to report, the theft or loss.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

(b) An individual or entity must notify APHIS or CDC immediately upon discovery of a release of a select agent or toxin outside of the primary barriers of the biocontainment area.

(1) The release of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information);

(ii) An estimate of the quantity released;

(iii) The time and duration of the release;

(iv) The location (building, room) from which the release occurred; and

(v) The number of individuals potentially exposed at the entity;

(vi) Actions taken to respond to the release; and

(vii) Hazards posed by the release.

(2) A completed APHIS/CDC Form 3 must be submitted within 7 calendar days.

[70 FR 13278, Mar. 18, 2005, as amended at 77 FR 61077, Oct. 5, 2012]

§331.20   Administrative review.

(a) An individual or entity may appeal a denial, revocation, or suspension of registration under this part. The appeal must be in writing, state the factual basis for the appeal, and be submitted to the Administrator within 30 calendar days of the decision.

(b) An individual may appeal a denial, limitation, or revocation of access approval under this part. The appeal must be in writing, state the factual basis for the appeal, and be submitted to the Administrator within 180 calendar days of the decision.

(c) The Administrator's decision constitutes final agency action.

[77 FR 61077, Oct. 5, 2012]



For questions or comments regarding e-CFR editorial content, features, or design, email ecfr@nara.gov.
For questions concerning e-CFR programming and delivery issues, email webteam@gpo.gov.