CDC's anthrax accident and the problems of self-regulation

The CDC’s most recent incident with the discovery of a strain of anthrax that was not what they thought it to be, that is, an attenuated or weakened strain, raises the same red flag that has been raised in previous incidents.  CDC is regulating itself, and it is apparent from their own internal investigation of the incident that they were not complying with their own requirements for experiment plans and specific protocols for each experiment, for response protocols or for biosafety standard operating procedures (SOPs) required for each experiment, point of contact (Responsible Official), etc.

But some of the more obvious problems with the regulatory structure in which biosafety and biosecurity should be achieved are evident in their own investigative report.  The CDC reported that it had “ceased operations” which is not what the regulating body should have done in this case.  The CDC should have at a minimum “suspended” its registration (42 CFR §73.8) which would not allow them to resume operations until a complete review of their biosafety and biosecurity plans and procedures and compliance had been verified by --- well, by them.  But there is more.  An incident such as this, resulting in a potential occupational exposure requires a reporting protocol, and a form completion within seven days of the incident (the incident was June 13):

 42 CFR §73.11(b) Upon discovery of a release of an agent or toxin causing occupational exposure or release of a select agent or toxin outside of the primary barriers of the biocontainment area, an individual or entity must immediately notify CDC or APHIS.

 (1) The release of a select agent or toxin must be reported by telephone, facsimile, or e-mail. The following information must be provided:

(i) The name of the select agent or toxin and any identifying information (e.g., strain or other characterization information),

                          (ii) An estimate of the quantity released,
                          (iii) The time and duration of the release,
                          (iv) The environment into which the release occurred (e.g., in building or outside
                          of building, waste system),
                          (v) The location (building, room) from which the release occurred,
                         (vi) The number of individuals potentially exposed at the entity,
                         (vii) Actions taken to respond to the release, and
                         (viii) Hazards posed by the release.

(2) A completed APHIS/CDC Form 3 must be submitted within seven calendar days. 

   The Freedom of Information Act should allow anyone to see how well they complied with this provision, but my experience with CDC was three years before a response to our FOIA request – another problem for another post.

   The CDC’s investigation report dated July 11, 2014 makes little attempt to cite any regulation that is violated and only references to needed improvements that are actually regulatory requirements are made without citing to any regulation.  It suggests that CDC’s investigation had little to do with the regulation or being regulated.  “Arrogance” is the word I am trying to avoid using too quickly, but it is becoming the elephant word in the room as I read the report. 

   The self-regulation in this case, bears review, and perhaps another department, like the Dept of Homeland Security, would be best suited to review the biosecurity compliance aspect, at least.  NIH, the sister agency of CDC within DHHS has more knowledge of biosafety than any other agency, even CDC, because they do more of the biodefense research than any other agency, and they would be well suited to be an advisory source for compliance.  But because NIH is regulated by CDC, this also sets up a conflict of interest where “mutual regulation” would be created. An external body could review the biosafety compliance if it was made up of conflict-free members who were not on the CDC payroll as consultants, but again, it is hard to find an expert who is not contracted with CDC to do inspections of laboratories.  Regulating CDC is not an easy problem to solve, but perhaps when a private accrediting association eventually emerges to accredit laboratories independent of CDC, they would be the place to seek a regulator of CDC’s own BSL facilities. 

    But my final word is that the real hero in this story is the scientist who discovered the unexpected growth of the anthrax on the discarded plates, and averted what could have been a biodisaster. 

    Congratulations and thanks to the individual scientists at CDC who are working to protect public health and safety, every day.  They are not the problem, it is the regulatory framework in which they work.