This is a case study on Canadian biorisk regulation for Arb Research, in response to a call for proposals by Holden Karnofsky. I’ve spent ~16 hours on this case study. It’s substantially based on Canadian government outputs, and a conversation I had with someone who works at the Canadian Centre for Biosecurity.
Overview of Canadian biorisk regulation
In 2009, Canada passed the Human Pathogens and Toxins Act (HPTA). This came into full effect in 2015 when the Human Pathogens and Toxins Regulations (HPTR) were published.
The Act and Regulations cover biosafety and biosecurity. The main provisions are:
HPTA is administered by the Centre for Biosecurity, which is part of the Public Health Agency of Canada (PHAC). The Centre is responsible for regulation and enforcement.
PHAC also issues the Canadian Biosafety Guidelines: “a series of biosafety and biosecurity themed guidance documents... that provide further details and recommendations on more specific topics.”
There are currently around 1000 licence holders in Canada.
Most interesting findings
Probabilities are my confidence in the claim (operationalised as the probability that I would still believe the claim after 40 hours’ more work).
- (75%) The system seems relatively comprehensive and flexible, and applies to emerging risks from bioengineered agents as well as existing risks.
- The Human Pathogens and Toxins Act and Regulations apply to the private and the public sector and are legally binding.
- All work with pathogens requires a licence, and work with the most dangerous pathogens also requires a security clearance.
- Reporting incidents is mandatory and is close to real time.
- There’s a database of all biological agents and their regulatory status, ePATHogen. If you want to do research on an agent that isn’t on ePATHogen, you first need to fill in a pathogen risk assessment template, so that the agent can be classified and added.
- Any gain-of-function research must be reported in advance to the licence holder and Biological Safety Officer.
- (85%) Compliance is very high.
- In 2021–22, 98% of compliance issues were successfully responded to within established timelines
- Since the HPTA, there has only been one prosecution, and no licences have been revoked
- It’s possible that high compliance just reflects low reporting, but I think the combination of mandatory reporting, inspections and licence renewals makes this pretty unlikely.
- (60%) Incentives seem more aligned with resolving compliance issues than with avoiding them in the first place.
- The main indicator the Centre uses to track effectiveness is % compliance issues successfully responded to within established timelines, and notification is non-punitive.
- The incentives these things set up have advantages, but they don’t directly create an incentive to minimise the rate of non-compliance in the first place.
- (>99%) The regulations contain provisions for cases of “serious and imminent danger to the health or safety of the public”, which empower the Minister of Health to act more quickly. In these cases:
- The Minister for Health can use an interim order to designate something an Security Sensitive Biological Agent (SSBA).
- The Minister for Health can notify a licence holder orally that their licence is suspended/revoked. The licence holder then has five days to dispose of or transfer any human pathogens or toxins.
- (>99%) There is a list of prohibited pathogens and toxins (currently only containing smallpox). It is illegal to conduct any work with agents on this list.
- (95%) The Ministry of Defence is de facto exempt from some of the regulations.
- The Minister of National Defence can refuse to give relevant information to the Minister of Health/inspectors.
- (99%) The costs and benefits of the regulations were explicitly estimated, and attempts were made to offset the administrative burden.
- A government CBA of the HPTAR a year before they were introduced showed that the regulations would at least break even. Presumably this was sufficient for introduction.
- The administrative burden of HPTAR was offset by repealing other regulation.
Notes on the dis/analogy with AI
Points of analogy
- Accident and misuse considerations
- More and less impactful risks to be managed
- There’s foundational research and applications to be regulated
- There are national security implications and interfaces
Points of disanalogy
- The risks in bio are much better understood
- Though AI synthesised pathogens might change this in future
- Less AI research happens in academia and the government than in the case of bio
- The riskiest bio work is more centralised than the riskiest AI work and the government has more influence
- As of 2019, all RG4 pathogens were consolidated in one federal facility.
- As of 2022, significant investment into biotechnology began to require the licensing private sector RG4 labs for the first time
- Maybe the intentions of bio researchers are more aligned with the public good?
- I spoke with someone who works at the Centre for Biosecurity. They worked in tobacco regulation before moving to the Centre. In their experience, regulated parties want to be biosafe and want to work compliantly. In tobacco, people were less interested in public health. For those who work with pathogens, the end game is public health rather than economics. The person I spoke with thinks that commercial motivations will be more prevalent in AI.
Scope of the regime
The HPTA covers “controlled activities”: “possessing, handling, using, producing, storing, permitting any person access, transferring, importing, exporting, releasing, abandoning, disposing” of a listed human pathogen or toxin.
The Act covers synthesised and recreated pathogens, as well as cultivated ones.
Canada uses a list-based system. There are various lists, for:
- Toxins
- Human Pathogens, from risk group 2 (moderate) to risk group 4 (high)
- Prohibited human pathogens and toxins (only smallpox at the moment)
- Security Sensitive Biological Agents (SSBAs): the overlap between risk groups 3-4, and the Australia Group list
The Minister for Health can add or subtract something from any of the other lists “by regulation”, following consultation of an advisory committee. The Minister for Health can also use an interim order to designate something an SSBA if there’s “serious and imminent danger to the health or safety of the public”.
There’s a database of all biological agents and their regulatory status, ePATHogen. If you want to do research on an agent that isn’t on ePATHogen, you need to fill in a pathogen risk assessment template, so that the agent can be classified and added.
HPTA does not apply to:
- “a human pathogen or toxin in an environment in which it naturally occurs, as long as it has not been cultivated or intentionally collected or extracted;
- a drug in dosage form whose sale is permitted under the Food and Drugs Act or a human pathogen or toxin contained in such a drug.”
The first exemption means that a lot of clinical work is exempt, but the vast majority of diagnostic facilities are still regulated by the Centre because they work with control samples, and they tend to use the standard in their institutions.
Also, the Minister of National Defence can refuse to give information to the Minister of Health and to HPTA inspectors
Main HPTAR provisions
Licensing
You need a licence to possess, handle, use, produce, store, permit any person access, transfer, import, export, release, abandon, or dispose of a human pathogen or toxin.
Some info:
- No fees
- Different licences for different risk levels of pathogen
- Maximum term is 5 years for least risky pathogens and 1 year for the most risky
- There are conditions, including compliance with CBS
- RG3 and RG4 facilities must submit a biosecurity plan and have a site inspection before licences are issued
- Licence holders need to keep a list of everyone with authorization to access the facility, including visitors
- To conduct scientific research you need to submit a "Plan for Administrative Oversight for Pathogens and Toxins in a Research Setting"
- “The purpose of the Plan is to facilitate the development of internal accountability structures and support accountability structures that currently exist by bridging gaps in the oversight of pathogens at an institutional level.”
- “PHAC has provided the required elements for inclusion and guidance information for each element of a Plan submission to facilitate the compliance with this regulatory requirement.”
Exemptions:
- Activity covered by other regulatory regimes
- Inspector/analyst carrying out HPTA functions
- Peace officer or anyone assisting them
- Anyone who collects samples for laboratory analysis of diagnostic testing
- Anyone working under a federal or provincial Act in exigent circumstances
- “A person who carries out laboratory analyses or diagnostic testing with a human pathogen that is neither a prion nor a prescribed human pathogen is exempt from requiring a licence as long as:
- they do not cultivate or otherwise produce a human pathogen; or
- if there is production, it is done using a sealed container that prevents the release of the human pathogen and the sealed container is decontaminated before its disposal or reuse.”
- “A veterinarian who is registered under the laws of a province - and any persons under their supervision - who carry out laboratory analyses or diagnostic testing with a human pathogen that falls into Risk Group 2 are exempt from requiring a licence (Section 7 of the HPTA) on condition that any controlled activities that they conduct in respect to that pathogen are conducted in the course of providing care to animals in a clinical practice in that province.”
If there is “a serious and imminent danger to the health or safety of the public”, the Minister for Health can notify a licence holder orally that their licence is suspended/revoked. The licence holder then has five days to dispose of or transfer any human pathogens or toxins.
HPTA Security Clearance
Any individual who works with or has access to Security Sensitive Biological Agents requires an HPTA Security Clearance.
SSBAs are the subset of risk group 3 and 4 pathogens which are also on the Australia Group list.
You also need an HPTA Security Clearance to work with toxins specified in HPTR above a certain quantity.
Some more info:
- Individuals without a security clearance may access relevant parts of the facility if there is one to one monitoring at all times by someone with security clearance
- Individuals who have had their security clearance suspended or revoked can’t access those parts of the facility under any circumstance
- No fee for security clearance, except $30-150 for fingerprints.
BSOs
Licensed labs must have a biological safety officer.
The qualifications for BSOs are:
- “(a) knowledge of microbiology appropriate to the risks associated with the controlled activities authorized by the licence, attained through a combination of education, training and experience;
- (b) knowledge of the provisions of the Act and the regulations and any applicable federal or provincial legislation; and
- (c) knowledge of the applicable biosafety and biosecurity policies, standards and practices appropriate to the risks associated with the controlled activities authorized by the licence.”
Their functions include reporting to the minister, monitoring compliance, assisting in developing policies, and running training for their institution. They don’t seem to be empowered to shut anything down.
Reporting requirements
HPTA licence holders have a legal obligation to inform the Minister of Health of:
- Inadvertent release of human pathogen/toxin
- Inadvertent production of human pathogen/toxin
- Disease caused by human pathogen/toxin
- Missing human pathogen/toxin
- Any changes to the physical structure, equipment of standard operating procedures of the facility, if they use risk group 3 or 4 pathogens or toxins
There is an online system for regulated parties to log these incidents. The median time between the incident and the reporting date in 2020 and 2021 was 6 days.
The Centre’s laboratory incident notification group monitors incident reports and triages those which require urgent response. There are internal standard operating procedures which specify which sorts of incident require urgent response.
Notification is non-punitive, and often the first step that the Centre takes in response to a notification is to call up the regulated party and try to understand what happened and why.
Individuals must also notify their licence holder and BSO before carrying out research that increases the virulence, pathogenicity or communicability of an agent.
“Biological safety officers keep an updated list of pathogens and toxins that are in the possession of the institution. PHAC keeps a national inventory of which risk groups are held within each facility. For dangerous pathogens and select toxins the exact inventory and location are recorded. Moderate risk pathogen and toxin inventories are maintained and kept at the institutions and reviewed upon inspection or request.”
There is quite detailed guidance for regulated parties on Notification and Reporting Under the HPTA and HPTR and on Incident Investigation.
Compliance and enforcement
At a high level, the Centre’s main levers on compliance are:
- Training and comms
- Monitoring incidents reported and issuing corrective actions
- Inspection
- Licence renewal
Full compliance activities here.
“Enforcement activities are delineated into 2 categories: Regulatory and Penal Enforcement.”
- Regulatory enforcement
- “It is further divided into administrative and inspection enforcement activities.”
- “The actions may include but are not limited to the following: issuance of letters of non-compliance; refusal to issue the Pathogen and Toxin Licence; variance or suspension or revocation of the Licence; undertake activities related to seizure, detention, forfeiture or disposal; or issuance of orders by an inspector.”
- Penal enforcement
- “Besides its regulatory and inspection mandate, the Centre has a law enforcement mandate. Both the HPTA/HPTR and HAA/HAR have offence provisions.”
- “The Centre's penal enforcement consists of two activities: investigation and prosecution.”
Criminal penalties
Maximum fines range from $50,000 to $1,000,000; maximum sentences range from 3 months to 10 years, depending on the severity of the risk posed. See here for a summary of all penalties.
There are exemptions where you’re not criminally liable if you “exercised all due diligence to prevent the commission of an offence under this Act”. (There are also exemptions to these exemptions.)
Inspection
Certified inspectors can enter any facility “at any reasonable time”, and have extensive powers.
RG3 and RG4 licence holders are inspected once per licence term - every 3 years for RG3, and every year for RG4.
RG2 licence holders are currently inspected every 8 years or so, though the hope is to reduce this to every 5 years, which is the maximum licence term. Apparently RG2 labs constitute a disproportionate number of exposure incidents.
There are currently 20 microbiology inspectors, 4 engineering inspectors, 2 inspection managers, and one engineering manager.
Infrequently, there are targeted document reviews in lieu of inspection, where for example scheduling is difficult.
The Minister of Defence can refuse to provide information.
How effective is the regime?
Probabilities are my confidence in the claim (operationalised as the probability that I would still believe the claim after 40 hours’ more work).
I think that:
- (75%) The Canadian system is quite effective relative to other systems. Reasons I think this, from most to least important to my view:
- (70%) It would be less effective at dealing with very extreme events than median events, and this is problematic. Reasons I think this, from most to least important to my view:
Strongest arguments for effectiveness
Compliance is very high
- Since 2018, the Centre has met its target of 85% compliance issues in Canadian laboratories successfully responded to within established timelines, which is the main indicator the department uses to track “Public health risks associated with the use of pathogens and toxins are reduced”. This indicator has been at 98% or higher for the past three years.
- Regulated parties are given time to correct deficiencies with standards/non-compliance with HPTA and HPTR
- Someone who works at the Centre for Biosecurty told me that in recent years, in cases where issues were not resolved, this was because they were resolved late, and not because regulated parties were opposing the corrections
- There has only been one prosecution since the HPTA in 2009.
- No licences have been revoked (though licence holders are good at applying for changes in their licence where appropriate)
- In 2014, “71% (181 of 234) of survey respondents indicated that their organization had adopted additional safety practices as a result of their engagement with the Centre for Biosecurity”, and a further 29% “reported that their organization was already in line with the requirements.”
It’s possible that high compliance just reflects low reporting, but I think the combination of mandatory reporting with inspections and licence renewals makes this pretty unlikely.
The Canadian system is well-regarded internationally
- The CBS is used by other countries, and Canada is involved in international efforts to increase biosecurity
- The WHO 2018 Joint External Evaluation rated Canada 5/5 for “Whole-of-government biosafety and biosecurity system is in place for human, animal, and agriculture facilities”, and 4/5 for “Biosafety and biosecurity training and practices”.
- The Global Health Security Index ranks Canada first in the world for biosafety (along with 15 other countries including the US), second for dual-use research (after Armenia, along with 4 other countries including the US), and third for biosecurity (after the US and Denmark).
- Canada has a perfect score on biosafety (100.0), but dropped points on biosecurity (86.7) and dual-use research (50.0).
- On biosecurity, Canada lost points because personnel working with dangerous pathogens are only required to have background checks, and are not also required to have drug testing and psychological/mental fitness checks.
- On dual-use research, Canada lost points because there is no legislation requiring DNA screening.
- Canada’s biosecurity score improved by 3 points from 2019 to 2021. On other indicators Canada’s scores were static.
- In conversation, a biosecurity expert told me that he thought the Canadian system was the best in the world.
- Pannu et al. (2022), in a Science paper, highlight the Canadian system as “address[ing] key elements” of the problem of dual-use research.
The system seems relatively comprehensive and flexible, and applies to emerging risks from bioengineered agents as well as existing risks.
- HPTAR apply to the private and the public sector and are legally binding.
- All work with pathogens requires a licence, and work with the most dangerous pathogens also requires a security clearance.
- Unlike many other countries where reporting of lab incidents is voluntary or retrospective, Canada has mandatory proactive reporting.
- Pathogens need to have a risk assessment before you’re allowed to work with them, so even though the system is list-based it’s not so consequential if a list is missing something.
- Any gain-of-function research must be reported in advance to the licence holder and Biological Safety Officer.
There are weak indications that risk has in fact reduced
It’s hard to tell what the impact on risk has been, because there isn’t data from before the HPTA, but there are some indications:
- The number of exposures has remained roughly constant even as the number of licences has grown significantly (with a peak in 2018 corresponding with a rise in licence numbers).
- As of 2022, no incidents had been reported involving SSBAs since 2017-18.
Other reasons
- The 2019 audit of the Biosecurity Program have been positive, though this was done by PHAC and so is quasi-internal
- I’ve failed to find much criticism of the regime. The criticisms I did find were all from government sources, and tended to be procedural, rather than relating to fundamental inadequacies.
Strongest arguments against effectiveness
There are weak indications that incentives are more aligned with resolving compliance issues than with avoiding them in the first place.
- The main indicator the Centre uses to track “Public health risks associated with the use of pathogens and toxins are reduced” is % compliance issues in Canadian laboratories successfully responded to within established timelines.
- On the one hand, this avoids incentivising the Centre not to find compliance issues, or incentivising them to find compliance issues which aren’t there.
- On the other, it also doesn’t create an incentive to actively reduce the rate of non-compliance.
- Notification is non-punitive.
- On the one hand, this presumably leads to higher reporting rates.
- On the other hand, it doesn’t disincentivise incidents occurring in the first place.
- For extreme events, you want to avoid them happening in the first place, as you don’t get the chance to correct afterwards.
The median time between incident date and reporting date is 6 days.
- For serious incidents, this doesn’t seem fast enough to me.
Laboratory exposure to human pathogens and toxins, 2021
A rate of ~5% of licence holders having an exposure incident every year seems high to me.
- It’s a bit difficult to know what the threshold should be though, and the rate of infections from those exposures is closer to 0.5%.
At the time of the 2019 audit, there was the potential for COI in case of an incident at the National Microbiology Lab, which was also the only RG4 lab in Canada.
- In 2019, the status quo was that if there were an incident at the NML (which is part of PHAC, like the Centre), then the analyst who investigated it could end up being from the NML too.
- I’m inferring that the NML was the only RG4 lab at that time (I think the direct information is classified): as of 2019 all RG4 pathogens in Canada were in one federal lab, Ebola is an RG4 pathogen, and the NML is a federal lab which conducted Ebola research projects before 2019.
AI synthesised agents might be hard to manage safely.
- The person I spoke with at the Centre for Biosecurity thinks that HPTAR is fit for purpose when it comes to AI synthesis of biological agents, because pathogens need to have a risk assessment before you’re allowed to work with them
- The person does note that completely unknown pathogens would be hard to deal with. The Centre tends to err on the side of caution, but it would be hard to justify risk group 4 without evidence
- I also guess that a large increase in pathogen risk assessment workload would not be resolved quickly (they’d need to hire new staff or learn to use AI to do it for them, and I don’t expect either of those would be speedy)
Other reasons
- At the time of the 2019 audit:
- The Centre’s risk register hadn’t been updated since 2016, though it was currently under review.
- The rate of inspection for RG2 labs equated to an inspection once in over 20 years.
- RG2 labs don’t deal with very dangerous pathogens, so from an underlying risk perspective this doesn’t seem that concerning to me.
- There were delays in the review of pathogen risk assessments, though the auditors thought it was very unlikely that this resulted in inappropriate containment levels in the interim “due to the Program’s close monitoring of emerging pathogens.”
- The 2022 PHAC evaluation of the Human Pathogen and Toxins Act and Regulations Framework raised the following issues:
- Expanding the security clearance process beyond those working directly with RG3 and RG4 pathogens
- Introducing continuous vetting of existing security clearances
- Significant investment into biotechnology requiring licensing private sector RG4 labs for the first time
- The WHO 2018 Joint External Evaluation noted “the need for an oversight framework on dual use in life sciences research”.
Background info
History of the regime
- Motivation for the HPTA in 2009, according to the person I spoke with at the Centre for Biosecurity:
- There was a recognition that there was a gap
- The previous legislation, HPIR, was just import
- The only kind of legislation which covered non-import work with pathogens was some occupational health and safety legislation
- The 2001 anthrax attacks prompted a recognition that using a criminal law statute (like HPTA) was perhaps the only way to appropriately deter and punish that type of behaviour
- Until the HPTR in 2015, the HPTA was not fully in force
- In developing the HPTR, PHAC considered continuing with no regulations, regulating under every part of HPTA, or minimal risk-based regulations. The latter approach was chosen
- Office of Biosafety Programs and Planning (OBPP) - develops biosafety policies and risk assessment; focal point for international discussions
- Office of Biosafety and Biocontainment Operations (OBBO) - administers HPTA/HPTR
- Office of Pathogen Security (OPS) - strategic oversight and assistance on biosecurity
- Office of Stakeholder Engagement and Regulatory Affairs (OSERA) - stakeholder comms
Costs of the regime
- From 2016-17 to 2019-20, the Centre’s expenditure ranged from $8.1m to $9.7m. In 2020-21 this increased to $41.8m in the wake of Covid.
- Canada has a One-for-One rule, which stipulates that:
- When a new regulation is made an old one must be removed
- When a new regulation increases administrative burden, this should be offset to an equal amount
- In the case of HPTAR, the HPIR was repealed, and the rest of the administrative offset came from “the Health Portfolio's bank of administrative burden savings.”
- In 2014, PHAC did a cost-benefit analysis on the HPTAR (which came into full force in 2015), and estimated that:
- In the first year, the incremental costs for regulated parties would total $2.4m, and government costs would be $6.8m.
- Over the first 20 years, the incremental costs for regulated parties would be $19.4m, and $77.3m for the Canadian government.
- Given the Centre’s actual expenditure from 2016 onwards, it seems likely that the government figure will be substantially exceeded.
- The cost-benefit analysis did not quantitatively estimate the benefits, but indicated that HPTAR would more than break even provided that they led to at least a 0.5% annual reduction in the risk of a SARS-like outbreak.
Brief notes on some of Holden’s other questions
If a standard aims to reduce risks, to what extent did the standard get out ahead of/prevent risks, as opposed to being developed after relevant problems had already happened?
- Accidental and deliberate releases and pandemics had all happened before HPTAR
How involved are/were activists/advocates/people who are explicitly focused on public benefit rather than profits in setting standards? How involved are companies? How involved are people with reputations for neutrality?
- The initiative for HPTA seems to have come from government
- I haven’t come across anything which suggests otherwise
- In 2009 there was criticism that stakeholders were not properly consulted about the HPTA.
Was there any influence of early voluntary standards on later government regulation?
Abbreviations
Select bibliography
Regulatory documents
Useful Centre for Biosecurity webpages
Evaluations of Canadian biorisk regulation
- Evaluation of the Biosecurity Program 2009–10 to 2013–14, Evaluation Directorate, 2014.
- International Health Regulations – Joint External Evaluation of Canada Self-Assessment Report, PHAC, 2018.
- Audit of the Biosecurity Program at the Public Health Agency of Canada, Office of Audit and Evaluation, 2019.
- 2021-GHS-Index-April-2022, downloaded from https://www.ghsindex.org/report-model/.
- 2021 GHS Index Country Profile for Canada
- Country score justifications and references: Canada, GHS Index, 2021.
- Evaluation of the Human Pathogens and Toxins Act and Regulations Framework 2015-16 to 2020-21, Office of Audit and Evaluation, 2022.
- Departmental Results Reports, PHAC.
Other useful sources
Executive summary: Canadian regulations for biorisk seem comprehensive and effective at compliance, though incentives may focus more on resolving issues than prevention, and gaps likely remain for extreme risks.
Key points:
This comment was auto-generated by the EA Forum Team. Feel free to point out issues with this summary by replying to the comment, and contact us if you have feedback.