SSBA Guideline 2 - Registered Facility Reporting Requirements – January 2014

Practical checklist covering transport requirements for security-sensitive biological agents (SSBAs).

Page last updated: January 2014

PDF printable version of SSBA Guideline 2 - Registered Facility Reporting Requirements (PDF 283 KB)

Introduction

This guideline provides information to registered entities and facilities about the reporting requirements under the Security Sensitive Biological Agents (SSBA) Regulatory Scheme and covers:

  • the National Register
  • the Data Collection System
  • the initial registration process
  • reportable events under the National Health Security Act 2007 (NHS Act) and the National Health Security Regulations 2008 (NHS Regulations)
  • the de-registration process
  • reporting suspected SSBAs

Mandatory Reporting

The NHS Act mandates that if an entity or a facility that is not exempt (see Fact sheet 4 – Exemptions) wants to handle SSBAs, it must register with and report certain information to the Department of Health (Health) about the handling of the SSBAs.

The National Register

The National Register of SSBAs (National Register) is established by the NHS Act and records details of registered entities and facilities handling SSBAs and suspected SSBAs. The information contained in the National Register holds a national security classification and only personnel with the appropriate level of clearance have access to the information to ensure the information is protected.

The Data Collection System

The Data Collection System (DCS) is a web-based system that allows entities and facilities to submit information about their SSBA handlings. Once the entity and facility is registered with Health, the Responsible Officer will be provided with a facility user name and password to access the DCS. Health has also developed paper-based forms that can be used as an alternative to the DCS. These paper-based forms are available on the SSBA website (www.health.gov.au/ssba).

Initial Registration

Entities and facilities must submit an Initial Registration report to Health within two business days of commencing to handle an SSBA. This form can be obtained from the SSBA website and can only be submitted to Health in hard copy by registered post. The Initial Registration form can not be submitted via the DCS.

The information required for an entity’s initial registration includes:

  • entity and facility details (See also Guideline 1 – Entities and Facilities)
  • Responsible and Deputy Responsible Officer details
  • SSBA details, including purpose for handling
  • SSBA Standards compliance declaration.

Once the required information is provided to Health and the purpose for handling the SSBA(s) is deemed legitimate, the information provided in the Initial Registration form will be recorded on the National Register.

If the purpose for handling the SSBA is deemed to not be legitimate, the entity and facility may be granted a temporary registration. Handling an SSBA for a purpose that is not legitimate may be an offence under the Crimes (Biological Weapons) Act 1976. The Secretary of Health will refer the matter to relevant authorities for investigation. If, after 12 months, no prosecution has been made under the Crimes (Biological Weapons) Act 1976, full registration will be granted. If a conviction is made the temporary registration will be cancelled.

top of page

Reporting Events as They Occur

The events listed below must be reported to Health as soon as possible and within two business days after the event has occurred. Reports can be submitted via the DCS or on the reporting forms listed after the reportable event below.

  • Starting to handle an SSBA that you are not registered to handle (Start to Handle an New SSBA)
  • Ceasing to handle an SSBA that you are registered to handle (Changes to Purpose for Handling an SSBA)
  • Handling a registered SSBA after a period of inactivity (Start to Handle an New SSBA)
  • Changing 1, ceasing or adding a purpose for handling an SSBA that you are already registered to handle (Changes to Purpose for Handling an SSBA)
  • Transferring an SSBA including reporting an unsuccessful transfer (sending or receiving) (Transfer In or Transfer Out)
  • Changing Responsible Officer or Deputy Responsible Officer details (Change of Responsible Officer Details)
  • The disposal of your entire holdings of an SSBA or if the remaining amount of toxin handled falls below the reportable quantity stated in the List of SSBAs (either via the Destruction or Transfer Out forms depending on the method of disposal).
  • Administrative changes to entity and facility details. (Change of Entity and Facility Details)

Reporting Events When They Are Discovered

The events listed below must be reported to Health as soon as possible and within two business days after the discovery of the event:

  • Unauthorised access or an attempt to access an SSBA or sensitive information relating to an SSBA
  • Theft or attempted theft of an SSBA
  • Accidental release of an SSBA
  • Loss of SSBAs either from the facility or during transfer (e.g. the package does not arrive at the final destination)
  • A person is affected by an SSBA as a result of the entity’s SSBA handlings.

These events can all be reported to Health, either via the DCS or in hard copy, using the Incident Report.

You are also required by the NHS Act to report loss, theft, attempted theft, unauthorised access or attempted unauthorised access to law enforcement agencies. For more information, see Guideline 5 - Reporting to Law Enforcement or the National Security Hotline.

Handling SSBAS Temporarily (Less Than 7 Working Days)

A facility that is temporarily handling a known SSBA it is not registered for must report to Health within two business days that it is handling the SSBA. The facility is permitted seven working days from initial receipt of the SSBA in which to complete the handling of the SSBA before it is required to dispose of the agent through transfer or destruction. At the end of this period, the entity must report the disposal of the SSBA to Health.

If the facility intends to continue handling after this seven day period, it must register to handle the SSBA.

During the handling period, the entity must comply with Part 11 of the SSBA Standards and must report any lost or stolen samples, or unauthorised access to the samples.

SSBA Standards include requirements that the entity:

  • limits the access to the SSBA to only persons who have a need to handle the SSBA;
  • maintains a record of who has accessed the SSBA including their identity and the date and time of access;
  • stores the SSBA securely – this could include a locked freezer, locked cupboard or locked containers within these devices;
  • destroys the SSBA so that no SSBA leaves the entity without being destroyed or inactivated unless being transferred;
  • validates waste disposal procedures; and
  • maintains records relating to this handling for 12 months for Tier 1 SSBAs and 6 months for Tier 2 SSBAs.
top of page

De-Registration

An entity or facility can apply to Health to cancel its registration after the entire stock of all SSBAs is disposed of (destroyed or transferred) or if the remaining quantity of toxin falls below the reportable quantity. If this application is granted, the entity or facility no longer needs to comply with the obligations of the SSBA Regulatory Scheme.

If the entity or facility starts to handle SSBAs again or the toxin quantity rises above the reportable quantity level, then the facility must submit a new Initial Registration form.

Reporting Suspected SSBAs

Reporting if you are not registered for the suspected SSBA

If you are registered to handle one or more SSBAs and, on the basis of your facility’s normal testing procedures, you suspect that you are handling an SSBA for which you are not registered, you must arrange for confirmatory testing or destroy the suspected SSBA as soon as possible and within two business days after forming your suspicion.

In-house confirmatory testing:

If you, as the initial tester, can perform confirmatory testing you must

  • report all outcomes (positive or negative) of the confirmatory test to Health;
  • if you intend to handle the SSBA, you must register to handle the SSBA and comply with the regulatory obligations for confirmed SSBAs within two business days of becoming aware of the result if the SSBA is confirmed; OR
  • dispose of the SSBA and report that this has occurred within two business days of becoming aware of the result if the SSBA is confirmed.

Transfer of the suspected SSBA to another facility for confirmatory testing:

If you send the suspected SSBA to another facility for confirmatory testing you must:

  • report the transfer to Health as soon as possible, but no later than two business days after the transfer;
  • report all outcomes (positive or negative) of the confirmatory test to Health;
  • if you intend to handle the SSBA, you must register to handle the SSBA and comply with the regulatory obligations for confirmed SSBAs within two business days of becoming aware of the result if the SSBA is confirmed; OR
  • dispose of the SSBA and report that this has occurred within two business days of becoming aware of the result if the SSBA is confirmed.

If you choose to destroy the sample and not carry out confirmatory testing you must do so within two business days of receiving the sample. You must also report to Health as soon as possible, but no later than two business days after the destruction of the suspected SSBA.

If you are required to retain the sample for longer than two business days for example, under the National Pathology Accreditation Advisory Council (NPAAC) guideline on Requirements for the Retention of Laboratory Records and Diagnostic Material you can request a longer time period for retention prior to disposal of the SSBA. If this request is granted, you will then have two business days after the subsequent disposal to report to Health. You do not need to apply for an extension to handle while you are waiting on the outcome of a confirmatory test.

Reporting if you are registered for the suspected SSBA

If you are registered to handle one or more SSBAs and, on the basis of your facility’s normal testing procedures, you suspect that you are handling an SSBA for which you are already registered, there are no additional regulatory and reporting obligations.

If you are a confirmatory testing facility that is already registered for handling the SSBA received there is no requirement for you to report the receipt of a suspected SSBA.

Reporting Process Flowcharts

The following flowcharts may assist entities to understand the reporting requirements and which forms to use.

  1. Receiving an SSBA
  2. Change of purpose for handling an SSBA
  3. Reporting administrative changes, including change of Responsible Officer or entity/facility details
  4. Disposal of an SSBA
  5. Incident Reporting
  6. Suspected SSBAs
  7. Temporary Handling

1. If the purpose for handling the SSBA is listed as research, any major changes to the research proposal must be reported to Health.


top of page

Flowchart 1 - Receiving an SSBA

D top of page

Flowchart 2 - Change of purpose for handling an SSBA

D top of page

Flowchart 3 - Reporting administrative changes, including change of Responsible Officer or entity/facility details

D top of page

Flowchart 4 - Disposal of an SSBA

D top of page

Flowchart 5 - Incident Reporting

D top of page

Flowchart 6 - Suspected SSBAs

D top of page

Flowchart 7 - Temporary Handling


D