Universities, feds fight to keep lab failings secret

Transparency is an important cornerstone in maintaining public trust in biological research, says the National Institutes of Health, which has issued guidance to laboratories that receive federal funding. While many research organizations answered USA TODAY's questions and provided basic records about their biosafety committees' work, dozens of others were not so forthcoming.

Some ignored information requests or attempted to charge hundreds of dollars in fees for records they are required to make public as a condition of their federal research funding. Others sought to conceal information about the pathogens they experiment with, lab mistakes or disciplinary actions taken by federal regulators. One lab even lobbied its state legislature for a bill to exempt its research records, citing USA TODAY's request for its biosafety records.

Several labs claimed that bioterrorism laws prohibited them from releasing any information about their work with pathogens designated as select agents — the regulatory term for viruses, bacteria and toxins that have the potential to be used as bioterror weapons. And many persisted in these claims even after reporters pointed out the labs' own press releases, websites and research papers touting their work with these same pathogens.

Regulators from the Federal Select Agent Program told USA TODAY there are no rules or laws restricting labs from discussing the type of select agent work they do or the names of the pathogens involved. The only prohibitions involve specific information about security measures — such as locations of keys or security codes.

"With the exception of specific security information (such as IT system passwords, key locations and lock combinations), the select agent regulations place no restrictions on the releasing [of] information related to select agents or toxins by regulated entities," said Jason McDonald, a spokesman for the Centers for Disease Control and Prevention, which co-runs the Federal Select Agent Program with the U.S. Department of Agriculture.

At the USDA, Freeda Isaac, director of Agriculture Select Agent Services, said in a statement: "The CDC and APHIS Federal Select Agent Program has not instructed entities to withhold select agent information from the public."

Last November, the NIH issued a memo to labs reminding them of the importance of transparency and that the names of pathogens or the principal scientists investigating them are "not generally considered private or proprietary" information to be withheld from the public. The NIH issued previous guidance to labs encouraging them to post their Institutional Biosafety Committee records on their websites, though USA TODAY encountered only a few that do this.

Noting information requests being filed by USA TODAY Network reporters, some biosafety officials from major research organizations last November discussed how they find public requests for biosafety information to be burdensome, questioned the qualifications of the public to review such records and indicated that charging fees may be a way to address their concern about proliferation of public review requests, according to a discussion on the listserv of the American Biological Safety Association.

Here are some labs and agencies where reporters encountered significant transparency issues:

Centers for Disease Control and Prevention; Atlanta and Fort Collins, Colo.

For nearly three years, USA TODAY has been unable to obtain key records about safety and security issues involving high-containment labs operated by the Centers for Disease Control and Prevention.

In June 2012, USA TODAY reported on leaked internal records and emails showing the CDC's labs in Atlanta had experienced significant failures of laboratory airflow systems used to contain pathogens, as well as repeated security lapses in areas where dangerous viruses and bacteria are kept. That same month, the newspaper filed requests under the federal Freedom of Information Act (FOIA) seeking additional records relating to airflow incidents in the agency's BSL-3 and BSL-4 labs; another request sought records of security incidents in a key Atlanta lab building.

The CDC, despite a history of lab safety issues, in 2012 denied USA TODAY's request that the agency search for and release the records on an expedited basis. In August 2014, the agency's FOIA office reversed its position and granted the requests expedited processing status after USA TODAY pointed out that the CDC's most recent lab safety lapses with anthrax demonstrated the public's need to know about biosafety at the agency.

Yet months continued to pass without the release of any records. Late last year, the CDC finally provided an estimated release date for the airflow and security records: Dec. 20, 2015.

Federal agencies often cite backlogs for delays in processing FOIA requests. The CDC reports that its average processing time is 153 days for a "complex" request and 47 days for a "simple" request. The CDC says it handled "expedited" requests in an average of 37 days — with 51 days being the "highest number of days" needed for expedited requests processed during fiscal year 2014, according to the agency's FOIA report.

While those two requests have been pending the longest, the CDC has also been slow to release other lab safety records to USA TODAY or has redacted key information from documents it has made public. Some examples:

• The CDC has not released any reports of incidents at its labs in Atlanta and Fort Collins, Colo., even though the agency said it would process the request on an "expedited" basis. USA TODAY requested the records, covering the period from 2013 through the present, on Jan. 6, 2015.

• The CDC in February 2015 denied USA TODAY's request for a copy of the initial, internal incident reports about a serious lab accident just before Christmas in which a worker was potentially exposed to live Ebola virus. The CDC cited the 2002 bioterrorism law as prohibiting release of the record, and instead directed the newspaper to a report of the incident the agency wrote for public distribution that it posted on its website.

• The CDC also serves as a regulator of other public and private labs that experiment with certain risky pathogens deemed to be potential bioterror agents. In September 2014, USA TODAY requested copies of records relating to enforcement actions the CDC had taken against the labs it oversees. On Jan. 13, 2015, the CDC released 11 pages of records about labs suspended or terminated from the program, but — citing provisions from the 2002 bioterrorism law —— removed the names of the labs it had sanctioned. An attorney for USA TODAY has appealed.

Colorado State University; Fort Collins, Colo.

Colorado State initially tried to charge $340 for copies of its Institutional Biosafety Committee minutes and related incident reports — and it blacked out the names of certain pathogens involved in research and mishaps.

"You really think $340 is excessive? Yikes," Linda Schutjer, a senior legal counsel for the university, wrote in a Nov. 19, 2014, email after USA TODAY objected to the fee as excessive. Schutjer said it took the university 17 hours to gather and review the records, even though it is required under the NIH Guidelines to make them available to anyone who asks as a condition of its federal research funding. After a series of emails, the university waived the fees.

But when the university released the records, USA TODAY discovered the names of many pathogens had been blacked out. The newspaper again filed a series of objections with the university, noting that Colorado State publicizes on its website that its scientists work with what appeared to be many of the redacted pathogens.

The university, in a Nov. 21, 2014, email, said it redacted names of select agents because of "security concerns" and that the decision to do this was based on consultation with "an expert" at the CDC.

After USA TODAY shared McDonald's statement with the university and said the newspaper would be filing a formal complaint with the NIH alleging violations of the transparency conditions of the university's federal research funding, Schutjer on Dec. 4, 2014, released another set of records that restored names of the pathogens.

University of Wisconsin; Madison, Wis.

University officials provided 420 pages of documents at no charge to USA TODAY. Shortly after the request was filled, university officials pointed to the process as grounds for a new state law that would restrict access to records of university research until that information is published or patented.

Gov. Scott Walker's 2015-17 budget proposed the law, which is similar to 24 other states' exempting university research from records release rules. UW made two prior attempts at passing the law in 2013 and 2014.

A UW spokesman called USA TODAY's request, "a very significant burden" and told a Wisconsin-based reporter that it "consumed much of one our employee's time for almost three-and-a-half months" because of the painstaking redactions.

However, the records are required to be made public as a condition of federal research funding, so the university spokesman acknowledged the law change would not alleviate the burden. The university also said it could not point to a specific instance of lost intellectual property or misappropriated research due to the existing state records requirements. In April, a top legislative committee removed the item from the budget proposal.

University of Massachusetts; Worcester, Mass.

The University of Massachusetts initially tried to charge $541.50 to release copies of its Institutional Biosafety Committee records, which are required to be made public under the NIH Guidelines as a condition of federal research funding.

Despite objections filed with the medical school that the fees were excessive, Associate Vice Chancellor James Healy said that they were not a deterrent to access and that the university deliberately used the lowest-paid employee to review and redact the records. The school provided a list of six individuals who needed to review the records.

One of those included the top Institutional Biosafety Committee member who would have been paid $60 per hour. After USA TODAY filed a complaint with the National Institutes of Health about excessive fees, the medical school provided the records at no charge.

The Scripps Research Institute; La Jolla, Calif., and Jupiter, Fla.

The institute redacted information from its biosafety committee minutes and incident reports before providing them to USA TODAY in December 2014. The names of pathogens, the topics of research, and information about safety concerns are among the information blacked out from the records.

In an email, Scripps attorney Kevin Cahill said the information was removed because it contained such things as "trade secrets, unpublished scientific hypotheses and research strategies, descriptions of experiments, proprietary methodologies, and materials and other confidential commercial or business information."

In January 2015, USA TODAY filed an appeal with the NIH, alleging that Scripps was in violation of the transparency requirements of its federal research funding and noted that the organization posts information on its website disclosing the research areas of scientists whose information was removed from the records. The appeal is still pending.

Lawrence Livermore National Laboratory; Livermore, Calif.

The lab's biosafety committee minutes, released under the federal Freedom of Information Act, indicate work in recent years with ricin, anthrax and MERS. But the minutes are often written in a way that makes them difficult to decipher without access to other documents that weren't publicly released.

For example, minutes from a June 10, 2014, meeting indicate discussion of a new application for research involving "Genetic characterization of risk group 3 viruses." But almost nothing is disclosed in the minutes about the substance of the project. The minutes say: "A review of the new project was given by the RI. The following changes were requested" and then it lists four changes that reference a document that wasn't released. Those changes say things such as "A.2.9 add isolates and source," and "A.3.1 change viral to MERS" and "A.7.3 add language that materials will be shipped from the university in Trizol."

Rush University; Chicago

The USA TODAY Network filed a request for Rush University's institutional biosafety committee meeting minutes and NIH-reported lab incidents on Nov. 11, 2014. The request was not answered and university officials did not respond to repeated requests for updates.

USA TODAY filed a complaint with the NIH in April 2015, alleging violations of the transparency requirements of federal research funding. The university promptly provided the records a week later. John Pontarelli, the university spokesman, said there was a misunderstanding about which records were requested.

U.S. Army Medical Research Institute of Infectious Diseases; Fort Detrick, Md.

The lab complex, known as USAMRIID, released nearly 300 pages of reports involving incidents at its labs during 2012, 2013 and 2014 — including dozens of incidents where full-body protective suits developed holes while scientists were working in biosafety level 4 labs. The Army redacted the names of workers, but also redacted significant sections of information about the nature and the extent of their exposures and the types of pathogens involved in the mistakes. In its response to USA TODAY's FOIA request, the Army said the information was being withheld because it presented a "clearly unwarranted invasion of personal privacy."

University of Kansas

The University of Kansas in Lawrence initially tried to charge $99 and the KU Medical Center in Kansas City initially tried to charge $295 for two sets of Institutional Biosafety Committee records, which are required to be made public under the NIH Guidelines as a conditional of federal research funding.

Despite objections filed with the two campuses that the fees were excessive, records custodian Debra Brogden said they were justified. After USA TODAY filed a complaint with the National Institutes of Health about the excessive fees, the university reduced its fee to $90 for both campuses.

When the university finally released the records in May 2015, it turned out that minutes from a single biosafety committee covered both campuses, and there were only six pages that appeared to be specific to the Lawrence campus, which had sought to charge $99.

The released records were heavily redacted. NIH Guidelines call for minutes to be "judiciously" redacted only for certain security and proprietary information. USA TODAY has filed a second complaint with the NIH about the redactions, which was pending at the time of publication.

University of Hawaii-Manoa; Honolulu

Although the University of Hawaii-Manoa released redacted versions of its biosafety committee minutes and incident reports to USA TODAY, it refused to release any records about enforcement actions taken against its labs for violations of federal rules for working with pathogens that are potential bioterror agents. The university cited the 2002 federal bioterrorism law among its reasons for refusing to release the records about its labs being put by regulators into performance improvement program. USA TODAY has appealed the denial to Hawaii's Office of Information Practices.

In response to USA TODAY's appeal, the university told the appeals office: "We do not believe entering into the program is an embarrassment, we think it should be showcased, but that would be improper because as participants in the Federal Select Agent Program, we are obligated to keep this information private." The university also told the appeals office it "has been an exemplary participant in the Federal Select Agent Program."

According to the CDC, labs are put into the performance improvement program for "repeated failure to correct past observation, biosafety and security concerns" or for failures to comply with certain security requirements.

In a separate letter to Hawaii's information practices office, university chancellor Robert Bley-Vroman said it is critical to keep the disciplinary records secret: "We believe that release of this information would present a danger to both national security and the health and welfare of residents of Hawaii."

In the biosafety committee minutes the university released to USA TODAY, it has redacted information that appears to involve its regulatory problems with the Federal Select Agent Program.

University of Nebraska, Lincoln, Neb.; University of Nebraska Medical Center, Omaha

The university initially sought to charge $540 to provide USA TODAY copies of biosafety committee minutes and NIH-reported incident records for the medical center in Omaha and for labs on its main campus in Lincoln.

After USA TODAY objected that the charges were excessive and not allowable under the transparency requirements of the NIH Guidelines, the university waived the fees.

The university said that although it still believed the fee "is not unreasonable or overly burdensome," it would "make an exception to its ordinary practice and will not charge for the costs of providing the requested minutes and reports. Please note that this exception is not a waiver of the University's right to charge an amount sufficient to cover the costs of providing documents in response to public records requests in the future," wrote Erin Busch, director of university records and associate general counsel.

Some sections of the minutes are redacted in their entirety. In an email, Busch said the redactions were done for security reasons or because the content contained "academic and scientific research work which is in progress and unpublished and other proprietary or commercial information which if released would give advantage to business competitors and serve no public purpose."

Wadsworth Center of the New York State Department of Health; Albany, N.Y.

The center provided copies of its Institutional Biosafety Committee's meeting minutes on Jan. 28, 2015 — only after USA TODAY filed a formal complaint with the National Institutes of Health, which requires entities receiving certain federal research funding to provide the records to the public on request. USA TODAY had sought the records since Nov. 5, 2014.

Plum Island Animal Disease Center, Plum Island, N.Y.

The Department of Homeland Security, which runs the center, initially refused to release names of certain pathogens that were involved in lab accidents, deleting them from records released in response to a FOIA request from USA TODAY. The department said the 2002 bioterrorism law prohibited their disclosure.

"After further review of these records, we have determined that our withholding of information pursuant to FOIA exemption (b)(3) Public Health Security and Bioterrorism Preparedness and Response Act of 2002 also known as the Bioterrorism Act was asserted in error." Many other redactions remain in the records.

University of Washington; Seattle

USA TODAY faced a series of bureaucratic delays in its efforts to review biosafety committee minutes from the University of Washington.

The newspaper filed a written request in October 2014 seeking copies of its biosafety committee minutes and any incident reports reported to the NIH. The request specified that the records were being sought under the transparency requirements of the NIH Guidelines, a key document labs must comply with as a condition of their federal research funding.

In emails over three months, a top research compliance official at the university told USA TODAY the request was being worked on. "Please rest assured that we are not ignoring your request," Joe Giffels, associate vice provost for research compliance, wrote in a Nov. 24, 2014, email.

After USA TODAY continued to seek updates on when the records would be released, Giffels sent emails in late January 2015 saying the newspaper would need to refile its request. "Please note that your request should state that you wish to receive the records under the Washington State Public Records law (not that you wish to receive them under NIH guidelines)," he wrote.

USA TODAY had told the university in previous emails that it was allowed to process the request under its state open records law, so long as the release of the records complied with the possibly greater transparency required by the NIH Guidelines.

USA TODAY filed a formal complaint with the NIH on Jan. 23, 2015, detailing the university's refusal to process the 4-month-old document request. On Jan. 27, 2015, the university agreed to release the records.

Officials at the NIH said they contacted the university "for an explanation of why this request took so long to fulfill. The University of Washington attributed this delay to a miscommunication regarding whether you consented for the University to process this request through the Washington State Public Records Act. The University of Washington also detailed to us the mitigation measures they are taking to avoid such delays in the future. You may also wish to know that in an effort to be more transparent, the University of Washington has begun posting its 2014 and 2015 IBC meeting minutes on a publicly available institutional website," according a letter the NIH sent to USA TODAY in February 2015.

George Mason University; Manassas, Va.

George Mason University initially sought to charge USA TODAY $167.65 for copies of its Institutional Biosafety Committee minutes and NIH-reportable incident records, which it is required to make public as a condition of its federal research funding. When USA TODAY objected to the fee as excessive for just 114 pages of records and asked for an itemized accounting, the university sent a copy of handwritten notes someone had written on lined paper that claimed even higher costs to release the records: $422.61.

The bulk of that cost involved two highly paid employees spending five hours each to review the records before release, the record said. A third employee spent two hours on the records, the university's breakdown said.

When USA TODAY asked for the dates and times these long reviews occurred, the university said the employees didn't log their time. However the university told USA TODAY it was reducing its fee to $100.59 because it had learned that some of the charges involved the employees meeting with each other about the newspaper's request.

USA TODAY filed a formal appeal with the NIH on Jan. 9, 2015, saying the fees were excessive and violated the NIH Guidelines' transparency requirements. Five days later, the university sent an email saying it was reducing its charges to $25.

"The University would like to note that this is a one-time reduction in cost, and that the cost of future FOIA requests to the University will be calculated according to Virginia law," wrote Elizabeth Woodley, the university's FOIA compliance officer.

The reduction was a result of USA TODAY's appeal to the NIH. "Yes, after consultation with NIH, we decided to further reduce the charge," Woodley said in another email.

Virginia Commonwealth University; Richmond, Va.

Virginia Commonwealth University initially sought to charge USA TODAY $239.09 for copies of its Institutional Biosafety Committee minutes and NIH-reportable incident records, which it is required to make public as a condition of its federal research funding. When USA TODAY objected to the fee as excessive and asked for an itemized accounting, the university sent an invoice that called for review by three workers making $23.67 to $36.05 per hour.

"Our calculation was done in good faith and without gratuitous expenses calculation," wrote Leila Ugincius, a university spokeswoman. "I certainly appreciate your concern about a charge, but I hope you will appreciate that as a public research university we get multiple requests for documents each week."

After USA TODAY filed a complaint with the National Institutes of Health, the university "reviewed and reconsidered the original charge" and provided the 134 pages of records for $45. Ugincius argued the time involved to access, copy and redact the documents "easily exceeded that amount."

U.S. Department of Agriculture, Animal and Plant Health Inspection Service

The USDA, along with the CDC, jointly runs the Federal Select Agent Program, which inspects and regulates labs that do research with risky pathogens that have the potential to be used as bioterror weapons or pose significant threats to public health or agriculture.

As USA TODAY sought records and asked questions about USDA's overall select agent enforcement activities, the agency gave a series of conflicting answers over the course of several months.

In October, in response to a public records request for enforcement documents, the USDA said it had no records because it had never needed to impose any fines or suspend or terminate any labs from its part of the select agent program. In November, Isaac, the USDA's select agent director, emailed a statement saying the same thing: "To date, we have not been in a position where we needed to levy a monetary penalty or revoke an entity's registration in full. Instead, we use various corrective actions, including Performance Improvement Plans, suspension of portions of an entity's registration, and letters of warning," Isaac said.

By December, USDA said it had given USA TODAY wrong information, and that the agency had actually conducted 48 enforcement investigations since 2003 that had resulted in $116,750 in fines. The agency, in response to a second public records request, said its enforcement records about these actions are required to be kept secret because of the 2002 bioterrorism law.

USDA did release a spreadsheet it says documents its actions, but the agency redacted almost all the information on it: lab names, violation types, dates. Only a few references to warning letters and fines were spared the agency's black marker.

The USDA also denied a separate FOIA request seeking copies of letters to labs notifying them they were being put in the select agent program's performance improvement program and that explain what violations the labs committed. In a March 2015 letter, USDA said it had identified 479 pages of records. "Unfortunately, we are withholding all 479 pages," the agency said, citing the Public Health Security and Bioterrorism Preparedness and Response Act of 2002.

USA TODAY has appealed the agency's refusal to release the information about enforcement actions and labs on PIPs.

University of California-Irvine; Irvine, Calif.

The university took three months to provide USA TODAY with copies of biosafety committee minutes and records of NIH-reportable incidents that are required to be made available on request as a condition of federal funding. NIH officials have suggested labs even post the records on their websites, though USA TODAY found that few labs do this.

When the university released its records on Feb. 4, 2015, the most recent records it provided were from a meeting that had occurred five months earlier in September 2014.

After USA TODAY filed a formal complaint with the NIH about the university's processing delays and the lack of recent records, the university on Feb. 28, 2015, released additional safety records covering October 2014 through January 2015. NIH officials, in a letter to USA TODAY, said that the university will be taking actions "to avoid such delays in the future."

Louisiana State University AgCenter; Baton Rouge, La.

LSU provided USA TODAY with copies of its biosafety committee records, but spent months denying reporters access to its records about a serious 2008 lab incident in which a bioterrorism bacteria used in experiments infected a cow in a nearby disease-free herd. An attorney for the university cited select agent regulations among the reasons for denying the newspaper's request under Louisiana's state open records law — and repeated appeals for reconsideration. After USA TODAY received documents about the incident from state and federal agriculture officials in December 2014, the university released the records the newspaper requested in August 2014.

To read more about these labs and review the records USA TODAY obtained, go to The 50-state interactive