United States Government Accountability Office Testimony Before the Subcommittee on Oversight and Investigations, Committee on Energy and Commerce, House of Representatives HIGH-CONTAINMENT For Release on Delivery Expected at 10:15 a.m. ET Thursday, November 2, 2017 LABORATORIES Coordinated Efforts Needed to Further Strengthen Oversight of Select Agents Statement of Mary Denigan-Macauley, Ph.D. Acting Director, Health Care GAO-18-197T Letter Letter Vice Chairman Griffith, Ranking Member DeGette, and Members of the Subcommittee: I am pleased to be here today to discuss our recent work on the oversight of select agents in high-containment laboratories in the United States. 1 Safety lapses have occurred at laboratories in the United States that conduct research on hazardous pathogens and toxins (known as select agents) that may pose a serious threat to humans, animals, or plants. 2 These lapses raise concerns about whether federal oversight of these laboratories is effective. For example, in November 2016, the Department of Homeland Security discovered that a private laboratory had inadvertently sent a toxic form of ricin (a potentially lethal poison) to one of its training centers multiple times since 2011, potentially putting training participants at risk. In May 2015, the Department of Defense (DOD) discovered that a DOD laboratory had inadvertently shipped live anthrax bacteria to nearly 200 other laboratories worldwide over the course of 12 years. And in July 2014, the National Institutes of Health discovered decades-old vials of smallpox in a storage room of a Food and Drug Administration laboratory on its campus. 3 We have, for many years, identified challenges and areas for improvement related to the safety, security, and oversight of high- containment laboratories. In 2009, for example, we found a proliferation of high-containment laboratories across the United States, with the number of such laboratories in the government, academic, and private sectors 1 GAO, High-Containment Laboratories: Coordinated Actions Needed to Enhance the Select Agent Program’s Oversight of Hazardous Pathogens, GAO-18-145 (Washington, D.C.: Oct. 19, 2017). Laboratories that conduct research on pathogens fall into one of four biological safety levels (BSL), with those at BSL-3 and -4 referred to as high-containment laboratories for the purpose of this statement. Each level of containment describes the laboratory practices, safety equipment, and facility safeguards for the level of risk associated with handling particular agents. BSL-3 laboratories work with indigenous or exotic agents with known potential for airborne transmission or pathogens that may cause serious and potentially lethal infections. BSL-4 laboratories work with exotic agents that pose a high individual risk of life-threatening disease by airborne transmission and for which treatment may not be available. 2 As of March 2017, 66 agents and toxins have been designated as “select agents and toxins”—that is, as needing specific types of safeguards and oversight. For the purpose of this statement, we use the term “select agents” to encompass both designated agents and toxins. 3 According to agency documents, none of these three incidents resulted in human infection, severe illness, or death. Page 1 GAO-18-197T High-Containment Laboratories increasing since 2001. 4 In addition, we found that there was no single entity overseeing this proliferation, and that no federal agency knew how many such laboratories existed in the United States or the aggregate risks associated with the proliferation. We also found in 2009 and 2014 that, for the subset of these laboratories subject to federal oversight, the oversight was duplicative, fragmented, and dependent on self-policing. 5 More recently, we found in 2016 that stronger oversight mechanisms for federal high-containment laboratories were needed at the individual federal department and component agency levels. 6 We have made numerous recommendations over the years, including that a single entity be identified to determine the number of high-containment laboratories needed to meet national goals, the aggregate risks associated with the proliferation of laboratories, and the type of oversight needed. 7 Federal departments have made some progress in implementing recommendations from our past reports, including addressing issues we identified regarding duplicative oversight. However, the United States still has not identified a single entity to perform the functions we recommended. All high-containment laboratories in the United States that register to work with select agents are regulated by the Federal Select Agent Program (which this statement subsequently refers to as the Select Agent Program), 8 through which two agencies share oversight responsibility. 4 GAO, High-Containment Laboratories: National Strategy for Oversight Is Needed, GAO-09-574 (Washington, D.C.: Sept. 21, 2009). 5 GAO, Overlap and Duplication: Federal Inspections of Entities Registered with the Select Agent Program, GAO-13-154 (Washington, D.C.: Jan. 31, 2014) and GAO-09-574. According to our past work, fragmentation refers to those circumstances in which more than one federal agency (or more than one organization within an agency) is involved in the same broad area of national need and opportunities exist to improve service delivery. GAO, 2017 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, and Duplication and Achieve Other Financial Benefits, GAO-17-491SP (Washington, D.C.: Apr. 26, 2017). 6 GAO, High-Containment Laboratories: Comprehensive and Up-to-Date Policies and Stronger Oversight Mechanisms Needed to Improve Safety, GAO-16-305 (Washington, D.C.: Mar. 21, 2016). 7 GAO-09-574. 8 Entities that register with the Select Agent Program may include a single laboratory or multiple laboratories under one registration. For the purpose of this statement, we refer to all entities registered with the program as “laboratories.” Some BSL-2 laboratories are registered with the Select Agent Program, but most registered entities are BSL-3 and -4 high-containment laboratories. For our October 2017 report, we focused on oversight of select agents in high-containment laboratories. Page 2 GAO-18-197T High-Containment Laboratories Specifically, oversight is shared by the Division of Select Agents and Toxins within the Department of Health and Human Services’ (HHS) Centers for Disease Control and Prevention (CDC) and the Agriculture Select Agent Services within the U.S. Department of Agriculture’s (USDA) Animal and Plant Health Inspection Service (APHIS). The program was established to regulate the possession, use, and transfer of select agents in response to security concerns following bioterrorism attacks in the 1990s and early 2000s. Other countries also regulate and oversee hazardous pathogens handled in high-containment laboratories, and they sometimes take approaches that differ from that of the United States. Moreover, other high-risk sectors in the United States, such as the nuclear industry, sometimes take different approaches to oversight. Notwithstanding such differences, our past work reviewing some of these sectors has identified five key elements of effective oversight in areas where low-probability adverse events can have significant and far-reaching effects. 9 These elements are as follows: • Independence: The organization conducting oversight should be structurally distinct and separate from the entities it oversees. • Ability to perform reviews: The organization should have the access and working knowledge necessary to review compliance with requirements. • Technical expertise: The organization should have sufficient staff with the expertise to perform sound safety and security assessments. • Transparency: The organization should provide access to key information, as applicable, to those most affected by operations. • Enforcement authority: The organization should have clear and sufficient authority to require that entities achieve compliance with requirements. My remarks today are based on our October 2017 report on the oversight of select agents in high-containment laboratories. Our report 9 In particular, we have used these elements for reviews related to oversight of nuclear safety and oil and gas management. See GAO, Nuclear Safety: Department of Energy Needs to Strengthen Its Independent Oversight of Nuclear Facilities and Operations, GAO-09-61 (Washington, D.C.: Oct. 23, 2008) and Oil and Gas Management: Key Elements to Consider for Providing Assurance of Effective Independent Oversight, GAO-10-852T (Washington, D.C.: June 17, 2010). Page 3 GAO-18-197T High-Containment Laboratories (1) examined the extent to which the Select Agent Program has the elements of effective oversight and has strategic planning documents to guide its oversight efforts, and (2) described approaches that selected countries and regulatory sectors have used to promote effective oversight. Today, I will discuss key findings and recommendations from that report. For our report, we discussed the five key elements of effective oversight above with agency officials, experts, and representatives from nongovernmental organizations to ensure their applicability to the oversight of select agents. We reviewed laws, regulations, and documents related to the Select Agent Program to determine the extent to which the program met the key elements. We also interviewed officials from CDC and APHIS and registered laboratories to discuss the program’s inspections and other oversight responsibilities and other issues related to the five key elements. To obtain expert views on the effectiveness of the approaches the Select Agent Program and other selected countries and regulatory sectors have used to promote effective oversight, we worked with the National Academy of Sciences to convene a 2-day meeting with 18 experts. We also reviewed relevant documentation and interviewed regulatory officials from selected countries—including the United Kingdom and Canada—and other sectors such as nuclear energy. More detailed information on the scope and methodology of our work can be found in the October report. The work upon which this statement is based was conducted in accordance with generally accepted government auditing standards. In summary, we found that the Select Agent Program does not fully meet all key elements of effective oversight. For example, the program is not structurally distinct and separate from all laboratories it oversees and, therefore, does not meet the key element of independence. Regarding another key element—the ability to perform reviews—some experts and laboratory representatives raised concerns that the program’s reviews may not target the highest-risk activities, in part because it has not formally assessed which activities pose the highest risk. Moreover, the program does not have joint strategic planning documents, including a joint workforce plan, to guide its shared oversight efforts. We made 11 recommendations to address these issues. HHS and USDA agreed with our recommendations and outlined actions they are taking, or plan to take, to address them. Page 4 GAO-18-197T High-Containment Laboratories The Select Agent Program does not fully meet key elements of effective Select Agent Program oversight. In particular, the program has oversight shortcomings related to Does Not Fully Meet each of our five key elements: independence, performing reviews, technical expertise, transparency, and enforcement. In addition, the Key Elements of program does not have joint strategic planning documents to guide its Effective Oversight or oversight efforts, such as a joint strategic plan and workforce plan. It did, however, begin taking steps to develop a joint strategic plan during the Have Joint Strategic summer of 2017. Planning Documents First, regarding independence, the Select Agent Program is not to Guide Its Efforts structurally distinct and separate from all of the laboratories it oversees because the two components of the Select Agent Program are located in CDC and APHIS, both of which also have high-containment laboratories registered with the program. Many experts at our meeting raised concerns that the Select Agent Program cannot be entirely independent in its oversight of CDC and APHIS laboratories because the Select Agent Program is composed of divisions of those agencies. To help reduce conflicts of interest, the program has taken steps such as having APHIS lead inspections of CDC laboratories. However, it has generally done so in response to concerns raised by others. The program itself has not formally assessed all potential risks posed by its current structure and the effectiveness of its mechanisms to address those risks. The Office of Management and Budget’s Circular A-123 requires federal agencies to integrate risk management activities into their program management to help ensure they are effectively managing risks that could affect the achievement of agency objectives. 10 In addition, federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. 11 Without (1) regularly assessing the potential risks posed by the program’s current structure and the effectiveness of its mechanisms to address them and (2) taking actions as necessary to ensure any identified risks are addressed, the 10 Office of Management and Budget, Management’s Responsibility for Enterprise Risk Management and Internal Control (Washington, D.C.: July 15, 2016). 11 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999), and Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014). GAO/AIMD-00-21.3.1 was effective through the end of fiscal year 2015 (Sept. 30, 2015). GAO-14-704G is the 2014 revision of GAO/AIMD-00-21.3.1 and became effective the first day of fiscal year 2016 (Oct. 1, 2015). Page 5 GAO-18-197T High-Containment Laboratories program may not be aware of or effectively mitigate impairments to its independence that could affect its ability to achieve its objectives. Second, regarding the ability to perform reviews, we found that the Select Agent Program performs several types of reviews to ensure compliance with regulatory and program requirements. However, the program may not target the highest-risk activities in its inspections, in part because it has not formally assessed which activities pose the highest risk to biological safety and security. 12 For example, many experts at our meeting and laboratory representatives we interviewed raised concerns about the amount of time inspectors spend assessing compliance with inventory controls (e.g., by counting and examining vials containing select agents) and reviewing inventory records during the inspection process, which takes time away from inspecting other aspects of biological safety and security. Experts at our meeting said that these activities do little to reduce the risk of theft of select agents (a security concern) because samples could be clandestinely removed from vials and replicated without being detected by the inventory controls currently in place. Further, other laboratory representatives told us that activities to assess compliance with certain program requirements, such as time-consuming reviews of records, did little to reduce risk and were unnecessarily burdensome to both researchers and inspectors. These inspection activities are generally intended to address biological security concerns; however, recent high- profile incidents at registered laboratories have concerned biological safety rather than security. To improve the inspection process and identify trends and associations between inspection findings and risk, a 2015 internal review of the CDC component of the Select Agent Program recommended that the CDC and APHIS components of the program work together to analyze inspection and investigation data. According to program officials, they have not yet addressed the recommendation because they do not currently have adequate tools to do so, but the program is transitioning to a new database that will enhance their ability to identify trends and associations and thereby guide improvements to the inspection process. However, the program did not provide a plan for when or how the program will carry out 12 We found in our past work that, according to experts and CDC officials, there is a baseline risk associated with any high-containment laboratory and that the risks from accidental exposure or release can never be completely eliminated. GAO, High- Containment Laboratories: Recent Incidents of Biosafety Lapses, GAO-14-785T (Washington, D.C.: July 16, 2014). Page 6 GAO-18-197T High-Containment Laboratories these analyses to improve the inspection process. Federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. 13 Without developing and implementing a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities, the Select Agent Program will not have assurance that it is effectively balancing the potential safety and security gains from its oversight efforts against the use of program resources and the effect on laboratories’ research. We also found that the Select Agent Program did not fully meet the other three key elements of effective oversight: technical expertise, transparency, and enforcement. For example, although the program has taken steps to hire additional staff and enhance the technical expertise of its staff, workforce and training gaps remain. In addition, although the program has increased transparency about registered laboratories and violations of the select agent regulations to the public and registered laboratories since 2016, the information it shares is limited and there is no consensus about what additional information could be shared, given security concerns. Lastly, although the program has authority to enforce compliance with program requirements, it is still working to address past concerns about the need for greater consistency and clarity in actions it takes in exercising this authority. In addition to not fully meeting the five key elements of effective oversight, we found that the Select Agent Program does not have joint strategic planning documents to guide its shared oversight efforts across CDC and APHIS. For example, the program does not have a joint mission statement to collectively define what the program seeks to accomplish through its oversight. It also does not yet have a strategic plan. Agencies can use strategic plans to set goals and identify performance measures for gauging progress towards those goals. Strategic plans can also outline how agencies plan to collaborate with each other to help achieve goals and objectives. The program began taking steps to develop a joint strategic plan during the course of our review and, in August 2017, began soliciting bids from contractors for the plan’s development. The statement of work for the contract stipulates that the contractor shall develop guiding principles for the Select Agent Program along with a mission statement 13 GAO/AIMD-00-21.3.1 and GAO-14-704G. Page 7 GAO-18-197T High-Containment Laboratories and strategic goals and objectives, among other requirements. However, it does not have any requirements related to development of a joint workforce plan. We have found in the past that agencies’ strategic workforce planning should be clearly linked to the agency’s mission and long-term goals developed during the strategic planning process. 14 Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program to better manage fragmentation by improving how it leverages resources to ensure all workforce and training needs are met. Leveraging resources is especially important given fiscal constraints. In our report, we recommended that CDC and APHIS take several steps to address these findings. First, we made five recommendations to improve independence, including that CDC and APHIS regularly assess the potential risks posed by the program’s structure and the effectiveness of its mechanisms to address those risks, and take actions as necessary to ensure any identified risks are addressed so that impairments to independence do not affect its ability to achieve its objectives. Second, to improve the ability to perform reviews, we recommended that the directors of the Select Agent Program work together to develop and implement a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities. We also made several other recommendations, including recommending that the directors of the Select Agent Program develop a joint workforce plan that assesses workforce and training needs for the program as a whole. Selected countries and regulatory sectors employ approaches to promote Selected Countries effective oversight that sometimes differ from those of the Select Agent and Regulatory Program by, for example, having regulatory bodies that are structurally independent from the entities they oversee or taking a risk-based Sectors Employ Other approach to performing reviews. To illustrate, with regard to Approaches to independence, Great Britain’s Health and Safety Executive, whose mission is to protect worker and public health and safety and which Promote Effective oversees laboratories that work with pathogens, is an independent Oversight government agency. According to officials from the Health and Safety 14 GAO, Human Capital: Key Principles for Effective Strategic Workforce Planning, GAO-04-39 (Washington, D.C.: Dec. 11, 2003). Page 8 GAO-18-197T High-Containment Laboratories Executive and laboratory representatives, one strength of this approach is that it avoids potential organizational conflicts of interest because none of the laboratories it oversees are part of the same agency. Some other regulatory sectors in the United States, including the Nuclear Regulatory Commission (NRC), are also structurally independent from regulated facilities as a mechanism to ensure independence. Prior to the creation of NRC in 1974, the U.S. Atomic Energy Commission was responsible for both promotion and oversight of the nuclear industry. The Energy Reorganization Act of 1974 established NRC as a separate, independent entity. According to a Senate committee report, this was a response to growing criticism that there was a basic conflict between the U.S. Atomic Energy Commission’s regulation of the nuclear power industry and its development and promotion of new technology for the industry. 15 Related to the ability to perform reviews, regulators in Great Britain and Canada apply a risk-based approach by targeting laboratories with a documented history of performance issues or those conducting higher- risk activities. In both Great Britain and Canada, the organizations that oversee laboratories generally focus their oversight on (1) biological safety, and (2) regulation of all potentially hazardous pathogens in laboratories. In contrast, the Select Agent Program originated from security-related concerns and regulates only those pathogens identified on the U.S. select agent list and no other pathogens that may be handled in high-containment but are not select agents, such as West Nile virus. Other differences we found in approaches include relying on scientists and other laboratory personnel to have requisite technical expertise on the pathogens and activities in their laboratories, sharing incident information on their public websites, and having prosecutorial authority when incidents occur. In conclusion, CDC and APHIS share a critical role in ensuring that important research on select agents can be conducted in high- containment laboratories in a safe and secure manner. The Select Agent Program has made a number of improvements over the past few years, such as hiring additional staff and improving training to enhance expertise. Nevertheless, the program does not fully meet all key elements of effective oversight and more is needed to develop joint strategic plans 15 S. Rep. No. 93-980 at 2 (1974). Page 9 GAO-18-197T High-Containment Laboratories to collectively guide its shared oversight efforts. In our prior work, we have found that existing federal oversight of high-containment laboratories is fragmented and largely self-policing, among other things. Our October 2017 report, in combination with these past findings, continues to raise questions about whether the current government framework and oversight are adequate. Vice Chairman Griffith, Ranking Member DeGette, and Members of the Subcommittee, this concludes our prepared statement. We would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this statement, please GAO Contacts and contact Mary Denigan-Macauley, Ph.D., Acting Director, Health Care, at Staff (202) 512-7114 or deniganmacauleym@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on Acknowledgments the last page of this statement. Individuals who made key contributions to this statement include Sushil Sharma, Ph.D., Dr.PH (Assistant Director); Amy Bowser; Caitlin Dardenne, Ph.D.; John Neumann; Cynthia Norris; Timothy M. Persons, Ph.D.; and Lesley Rinner. Staff who made key contributions to the report(s) cited in the statement are identified in the source products. (102355) Page 10 GAO-18-197T High-Containment Laboratories This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. The Government Accountability Office, the audit, evaluation, and investigative GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO GAO Reports and posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to http://www.gao.gov Testimony and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov and read The Watchblog. Contact: To Report Fraud, Website: http://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in E-mail: fraudnet@gao.gov Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125, Relations Washington, DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.