House of Commons - Innovation, Universities, Science and Skills

Select Committee on Innovation, Universities, Science and Skills Sixth Report

2 The regulatory framework

18. The regulatory frameworks governing the use of dangerous pathogens are based on the categorisation of pathogens into four groups. Pathogens that are handled at Containment Level (CL) 1 pose least risk whilst those at CL4 present the greatest risk. Dangerous pathogens are those classified CL3 or CL4, although CL4 containment is significantly more complex and expensive than CL3 containment.

19. Currently a number of parallel sets of regulations and systems of categorisation are in operation in relation to dangerous pathogens:[21]

The Specified Animal Pathogens Order 1998 (SAPO) regulates the use of animal pathogens and was, until recently, administered by Defra in England, the Scottish Executive and the National Assembly for Wales. Following the Callaghan report (see below), HSE is now the inspection and enforcement body under SAPO across Great Britain. SAPO is a licensing system where the licence specifies the conditions under which the pathogen can be handled, following an inspection of the laboratory and close examination of supporting documentation. Licences are usually valid for 5 years. Specified animal pathogens are classified into four categories (SAPO1-4);
The Control of Substances Hazardous to Health Regulations 2002 (COSHH) regulations are wide-ranging, and are not devoted to regulation of dangerous pathogens. HSE is the competent authority under COSHH across the UK. Like SAPO, COSHH classifies pathogens into hazard groups 1-4, based on the threat to human health as detailed in the 'Approved List of Biological Agents',[22] drawn up in consultation with the ACDP, an independent committee which advises the HSE, DH and Defra as well as the Devolved Administrations on all aspects of exposure to pathogens. ACDP is serviced by a joint secretariat (HSE, Defra, and the HPA).[23] CL assignments under COSHH are often referred to as ACDP 1-4. In contrast to SAPO, COSHH regulations require only that work is notified to HSE at least 20 days before it begins, although the HSE can request further information following notification;
The Genetically Modified Organisms (Contained Use) Regulations 2000 GMO(CU) regulates pathogens which have been genetically modified and assigns a class of containment based on a risk assessment. Requirements differ from COSHH since the regulations are designed to protect the environment as well as the worker. For pathogens falling into class 2, 3 or 4, notification (including a risk assessment) is required and at class 3 or 4, permission is required before work commences. Responsibility for GMO(CU) is devolved in Scotland but not in Wales, so that the HSE and Defra in England and Wales and the HSE and the Scottish Executive in Scotland are the competent authorities;
Part 7 of the Anti-terrorism Crime and Security Act 2001 (ATCSA) applies across the UK and allows the police to impose security measures in those laboratories handling pathogens and toxins on a list in Schedule 5 of the Act, use of which must be notified. The Act covers around 400 laboratories in the UK. ATCSA is implemented by the National Counter-Terrorism Security Office (NaCTSO), a national police unit, which provides policy advice and police training.

We are aware that similarly complex regulatory systems are in place around the world, for example in Germany where the involvement of regional authorities adds an extra dimension.[24]

20. Pathogens may be categorised differently under two or more systems, for example SAPO4/ACDP3, and requirements for the same level of containment can differ, for example between SAPO4 and ACDP4. In addition, laboratories operating at a particular containment level are not identical. The containment measures and standard operating procedures will depend on the pathogen being used but also the protocols. Diagnostic and research laboratories present different risks as a result of the nature of the work. CL4 laboratories can vary widely in their capabilities and capacity as we discuss in detail below. In recognition of this, derogations are often awarded;[25] for example, Dr Paul Logan of the HSE explained that:

The Callaghan review

Criticisms of the existing regulatory framework

21. In the wake of the FMDV outbreak at Pirbright, the Secretary of State for Environment, Food and Rural Affairs commissioned a review from Sir Bill Callaghan of the regulatory framework governing the handling of animal pathogens and Defra's role as regulator under SAPO. This further review was one of the recommendations of the Spratt Review which highlighted the potential conflict of interest that existed at Pirbright where Defra was both a customer, and the regulator under SAPO.[27]Callaghan identified the existing regulations as "complex and disjointed"[28] (a conclusion with which others agree)[29]and described the existing regulations relating to human and animal pathogens as having "differing regulatory philosophies and practices, and different levels and types of inspection, enforcement and sanctions."[30] The SAPO regime received particular criticism. The resources allocated to regulation were limited, with under half the time of one Defra veterinary official to cover all the SAPO4 laboratories. Enforcement of the regulations was the responsibility of trading standards officials who, according to the Callaghan review, have never used these powers.[31] Callaghan concluded that:

22. Callaghan was not alone in identifying failings of the existing regulatory system. Iain Anderson's review of the 2007 FMDV outbreak concluded that it had highlighted "weaknesses in the total regulatory system, not the failure of one individual. The Defra regulator, for example, was doing his best with limited resources."[33] He added that "Defra's regulatory regime was insufficiently robust given the level of risks on the site".[34] Defra itself was already considering changes to the SAPO regime and whether a move to a single regulator was desirable.[35]

23. Callaghan was clear that at Pirbright "in the face of the published correspondence from Merial about the state of the drains … an independent regulator such as HSE would have ... taken steps to ensure the drains were functioning properly."[36]

24. The failings of the regulator therefore appear to have been a contributory factor to the FMDV outbreak. However, when challenged by us Defra officials would not accept that faults in regulation were behind the outbreak. Dr Nick Coulson of Defra told us that:

CALLAGHAN'S RECOMMENDATIONS

25. Sir Bill Callaghan suggested that there should be a new, unified regulatory framework for human and animal pathogens based on risk-assessment with a common set of containment measures developed by ACDP and that the HSE should be the competent authority. He recommended that the framework be in place by the end of 2008 and that in the meantime the HSE should take responsibility for inspection and enforcement under SAPO as part of a series of phased changes to be completed by April 2008.[38] The Government accepted all the recommendations made in the review.[39] Support for the findings was widespread in the evidence we received.[40]

IMPLEMENTATION OF THE CALLAGHAN REVIEW

26. We are encouraged that the timetable for the proposed new framework is currently being met. On 28^th April 2008 the HSE became the enforcement and inspection body under a revised SAPO. The process of developing the new single regulatory framework has also begun.[41] The ACDP met on 5^th February 2008 to begin work on a common set of containment measure to apply to animal and human pathogens.[42]

27. Consolidating three different sets of regulations into a single regulatory framework will not be easy given the different bases on which they currently operate.[43] Sir Bill Callaghan pointed out that COSHH places responsibilities on employers to control risk, SAPO regulates the possession of controlled pathogens by individuals and GMO(CU) requires a person carrying out an activity to do so safely and to carry out a risk assessment.[44]

28. One of Callaghan's key recommendations was that the new regulatory framework be based on risk assessment. As described above, SAPO is a licensing regime, work under COSHH requires notification and GMO(CU) requires permission.[45] In other countries a mixture of systems operate, with the Netherlands and Canada operating a permit system and Switzerland a licensing system.[46] Callaghan described licensing regimes as "more rigid" and commented that under SAPO the regulator lacked sanctions except the removal of the licence.[47] Others agreed, with the HSE considering this an endorsement that "our risk assessment approach is seen as a modern way of regulating rather than issuing licenses."[48] However, this view was not universal and other evidence suggested that it is possible for a licensing system to work well.[49] Andrew Thompson, Biological Safety Officer at Oxford University asserted that with licensing "the process is, if anything, more vigorous and more controlled than that undertaken for human (ACDP) pathogens."[50] Robert Osborne, Biological Safety Adviser at Glasgow University argued that in the short term a notification regime could allow poor practice and recommended that permission be required for work to commence.[51]

29. Lord McKenzie, the Minister with responsibility for the HSE, told us that it is still to be decided whether the new regulatory framework will be a permissioning or notification regime but that a licensing regime is not being considered.[52] Sir Bill Callaghan was very clear that "the model we have for the single regulatory framework is based on the GMO (Contained Use) Regulations,"[53] where permission is required to start work at CL3 or CL4. We note that at present a similar system is operated informally by the HSE under COSHH; even though the approval of the regulator is not strictly required, in practice the HSE told us that they:

30. As described, the regulations that govern work with dangerous pathogens are devolved in a complex pattern with multiple agencies as a competent authority, for example under GMO(CU).[55] Dr Paul Logan of the HSE told us that devolution complicated the issue but that:

It should be noted that the systems in Germany and Switzerland operate to a large extent at a local rather than federal level without any apparent problems.[57]

31. Witnesses stressed to us that it will be important in developing the new framework to focus on reducing, not creating complexity.[58] The Wellcome Trust suggested that

However, it is possible to oversimplify the system inappropriately. Some areas require expertise that the HSE will not have available. For example, counter-terrorism and security needs to be enforced by specialists (Home Office, NACTSO etc). In common with other witnesses,[60] Dr Paul Logan's view was that for the HSE to be "working closely together [with the security services] is probably the best answer, rather than trying to take on those functions."[61]

32. We support the conclusions reached by Sir Bill Callaghan and believe that a single, unified regulatory framework for human and animal pathogens based on risk assessment is the appropriate step forward. We urge the Government to ensure that regulation of work on dangerous pathogens is simplified as far as is practicable with the minimum number of bodies involved, although it may be appropriate for some specialist areas such as counter-terrorist inspection to be administered separately in accordance with the common framework. The Government should co-operate with the devolved administrations to ensure that a similarly high standard of regulation occurs across the UK.

33. We recommend that the new unified regulatory framework be a permissioning regime such that approval by the regulator should be required before work can start where an application for work at CL3 or CL4 has been submitted.

Categorisation of pathogens and containment measures

34. The categorisation of pathogens is regularly reviewed by ACDP to account for changes in drug resistance, virulence etc.[62] In the wake of the Callaghan review, as part of the new unified regulatory framework, ACDP has been tasked with formulating a common set of containment measures for human and animal pathogens.

35. Whilst many dangerous pathogens are zoonotic and infect humans and animals, it may be difficult to formulate a common set of containment measures appropriate for human pathogens and those animal pathogens at the extreme of the spectrum (e.g FMDV) which pose no danger to humans and are therefore classified as SAPO4/ACDP1. Under current SAPO4 containment human operators often come into direct contact with the agent. Callaghan's view was that "if you say something is level 1 it sounds as if it is not really important."[63] His review expressed concern that:

Professor Griffin, chairman of the ACDP, suggested that "animal pathogens under SAPO will have tighter regulations than before."[65] In safety terms the benefits of such an approach are obvious. However, increasing the precautions required for work on pathogens such as FMDV may serve to deter scientists from carrying out such work and make it prohibitively expensive.

36. The Society of General Microbiology (SGM) expressed concern that some microbes previously handled in undergraduate practicals are now considered 'dangerous' and that overall too many pathogens are now defined as dangerous.[66] There is a danger that a lack of evidence-based risk assessment could lead to an inflation of the containment levels required for handling particular pathogens. Michael Stephens of the Institute of Safety in Technology and Research told us that:

Within a new, common regulatory framework for animal and human pathogens, risk assessment should determine the biorisk management strategy for containment laboratories.

37. We support a common set of containment measures for animal and human pathogens and urge ACDP, in drawing up these measures, to protect the principles of evidence-based risk assessment. They should consider the implications for the viability of important research if unnecessary containment measures are imposed. We expect ACDP to maintain its regular review of required containment measures and the classifications of pathogens under the new framework.

Transport of pathogens

38. The transport of dangerous pathogens falls outside the new unified regulatory framework, given that it has an international element and requires co-operation at this level. For the most part, those submitting evidence considered transport regulations to be adequate.[68] The Importation of Animal Pathogens Order 1980, as amended, prohibits import of pathogens from outside the EU without a licence from Defra, the Scottish Executive or Welsh Assembly. The Carriage of Dangerous Goods and Use of Transportable Pressure Equipment Regulations 2007, enforced by the HSE, transpose international regulations originating at the UN and define two categories of infectious substances for which the transport conditions differ. The international air transport association also has its own transport regulations. In addition to the specific legislation on this issue, SAPO licences also stipulate transport conditions and COSHH requires notification to the HSE before CL4 pathogens are moved to another site. We received a suggestion that better contingency plans were needed for loss and damage of packages containing dangerous pathogens during transportation[69] and a warning that if transport of samples became prohibitively expensive, it would be detrimental to the essential exchange of samples, especially important in the work of Reference Laboratories.[70] The Department for Transport is currently reviewing the transport of dangerous goods, in particular Very High Consequence Dangerous Goods. This may present an opportunity, in the spirit of the Callaghan Review, to rationalise regulation in this area.

Gaps in the regulations

39. The development of a new unified regulatory framework also provides the opportunity to identify any gaps in the current regulations. Dr Paul Logan of the HSE told us that "the keeping of inventories is something that is quite often raised" and that this is becoming more commonplace.[71] Present legislation covering work on dangerous pathogens stipulates "secure storage". At CL4, organisms must only be stored within the laboratory, and fridges, freezers and storage containers should be kept locked. NaCTSO, through Counter-Terrorism Security Advisers (CTSAs), carry out security audits under ATCSA. However, this is another area which lacks clarity. SAPO licences require details to be kept of storage locations, quantities and disposal[72] but COSHH and GMO(CU) regulations do not. RCUK suggested a "single nationally accepted system for logging information on the storage of dangerous pathogens" and "a standard labelling system". They also pointed out that "there is no formal requirement, as for example for radioactive material, to account for missing pathogens".[73] However, other witnesses suggested that the quantitative recording of dangerous pathogens may not be practicable[74] and that there is a possibility that clearly identifying pathogenic material may make it more vulnerable to theft.[75] Professor Shirley of the IAH told us that ultimately, no system can completely protect from malicious behaviour.[76]

Responsibility for biosecurity

40. Whilst the regulatory system provides the framework within which dangerous pathogens can be handled, ultimately the responsibility for managing risk lies with those who manage the site.[77] The ACDP guidance for running containment level 4 facilities notes that:

41. A clear definition of where responsibility for biosecurity lies is vital and it is important on a site of shared ownership to identify 'the controlling mind' as in the principles of Health and Safety legislation.[79] The difficulties that can arise when this is not clear are starkly illustrated by the outbreak of FMDV at Pirbright, where a number of problems were identified with the complexity of the governance on the site and lack of communication between different parties.[80] The HSE highlighted that in general the situation is improving:

42. Witnesses emphasised the need for a strong safety culture to pervade all organisations using dangerous pathogens.[82] Biological safety officers/advisers (BSOs) are key to successful biorisk management. The ACDP guidelines emphasise that:

There is widespread support for a more high profile role for BSOs and for giving them professional status.[84] The Wellcome Trust advocated that the role of BSOs could be built into the regulatory framework.[85]

43. There should be complete clarity over who is responsible for biosecurity, especially on a site of mixed ownership or sponsorship such as at Pirbright. The 'controlling mind' must be clearly identified and be expected to manage the risks that it creates. Ultimate responsibility for biosecurity rests with managers of a facility. A strong safety culture is essential for good biosecurity and all those who fund and operate high containment laboratories should ensure that this exists.

44. We support the role of Biological Safety Officers in enforcing biosecurity and recommend that the Government and the HSE in particular look at ways to support and reward this profession appropriately given the level of responsibility it holds, firstly by establishing a formal accreditation process.

21 Ev 51-61 Back

22 ACDP, The Approved List of Biological Agents, 2004, www.hse.gov.uk/pubns/misc208.pdf Back

23 Ev 95 Back

24 Ev 127-128 Back

25 Ev 63 Back

26 Q 83 Back

27 Professor Brian Spratt and review team, Independent Review of the safety of UK facilities handing foot-and-mouth disease virus, August 2007, p 58 Back

28 Q 9 Back

29 Ev 54, 82, 90 Back

30 Sir Bill Callaghan, A Review of the Regulatory Framework for Handling Animal Pathogens, 13 December 2007, p 20 Back

31 Q17, Sir Bill Callaghan, A Review of the Regulatory Framework for Handling Animal Pathogens, 13 December 2007, p 10 Back

32 Sir Bill Callaghan, A Review of the Regulatory Framework for Handling Animal Pathogens, 13 December 2007, p 19 Back