Alison Young

USA TODAY

Scientists wearing space-suitlike protective gear searched for hours in May for a mouse — infected with a virus similar to Ebola — that had escaped inside Rocky Mountain Laboratories in Montana, one of the federal government's highest-security research facilities, according to newly obtained incident reports that provide a window into the secretive world of bioterror lab accidents.

During the same month at St. Jude Children's Research Hospital in Memphis, a lab worker suffered a cut while trying to round up escaped ferrets that had been infected with a deadly strain of avian influenza, records show. Four days later at Colorado State University's bioterrorism lab, a worker failed to ensure dangerous bacteria had been killed before shipping specimens — some of them still able to grow — to another lab where a worker unwittingly handled them without key protective gear.

Nobody was sickened in the incidents and the mouse was caught the next day. Yet in the wake of serious lab mishaps with anthrax and bird flu at the Centers for Disease Control and Prevention that prompted an uproar and a Congressional hearing this summer, these additional incidents are further fueling bipartisan concern about lab safety.

"As long as we keep having an ad hoc system of oversight in this country, we're going to keep seeing more and more incidents," said U.S. Rep. Diana DeGette of Colorado, the ranking Democrat on the House oversight subcommittee that held the hearing in July.

Added subcommittee Chairman Tim Murphy, R-Pa.: "These incidents underscore why the committee has been investigating the safety of high-containment labs."

The CDC and the U.S. Department of Agriculture jointly run the Federal Select Agent Program that oversees government, university and private laboratories working with dangerous viruses, bacteria and toxins called "select agents" because they're deemed to pose serious threats to people and agriculture and could potentially be used as bioweapons. Most of these facilities are "high-containment" laboratories operating at biosafety levels 3 and 4, the highest levels. Each level has increasingly sophisticated safety equipment and protocols to protect researchers from infection and keep deadly pathogens from being released.

The Government Accountability Office, which is the investigative arm of Congress, has warned for years that no single federal entity is responsible for oversight of high-containment labs and there are no national standards for their design or operation. It isn't even known how many high-containment labs are in operation nationwide because those working with dangerous pathogens that aren't on the federal "select agent" list — such as tuberculosis, MERS-CoV coronavirus and some potentially deadly bird flu strains — aren't required to register with the CDC-USDA program.

Citing bioterrorism laws, the Federal Select Agent Program doesn't publicly release details about accidents occurring in regulated labs. More than 1,100 incidents involving select agents were reported by labs from 2008 through 2012 and more than half were serious enough workers received medical evaluation or treatment, USA TODAY reported in August after obtaining copies of the program's annual reports to Congress. The reports, however, don't name the labs and provide few details beyond tallies of incidents by type.

The details of the May incidents were revealed in minutes of those labs' institutional biosafety committees and related reports obtained by Edward Hammond, former director of the Sunshine Project, an independent lab watchdog group that operated from 1999-2008, until it lost funding.

Hammond said it's difficult for policymakers and the public to judge the safety of labs and weigh the risks and benefits of proliferating bioterror-related research projects without data on how often incidents occur and details about what happened.

"We need to require reporting and for reporting to be public," said Hammond, now a researcher based in Austin.

Since August, Hammond has been requesting minutes of recent biosafety committee meetings from about 100 labs across the country and is in the process of reviewing the records to identify incidents. Entities that receive funding for recombinant DNA research from the National Institutes of Health are required to make certain records available to the public, including biosafety committee minutes.

Among the initial records Hammond has received and reviewed so far, he identified those at Colorado State, St. Jude and Rocky Mountain National Laboratories as among the most troubling and provided copies to USA TODAY.

Colorado State University

At Colorado State University in Fort Collins, home to the Rocky Mountain Regional Center of Excellence for Biodefense and Emerging Infectious Diseases Research, records show there were two significant lab accidents in May. The university blacked-out key information in the documents – such as the names of the pathogens and researchers involved in the accidents. Although the university cited select agent rules as the reason for the redactions, it routinely publishes on its website the names of researchers and the bioterror agents they study.

University officials answered questions about the incidents in interviews with USA TODAY.

On May 16, a researcher, in a biosafety level 3 (BSL-3) lab boiled tubes containing specimens of Burkholderia pseudomallei that had been genetically modified to be resistant to the antibiotic kanamycin, records show. The bacteria, which can sicken people and animals with a variety of symptoms including pneumonia and life-threatening bloodstream infections, are classified as a Tier 1 select agent – a designation given by the federal government to a handful of pathogens deemed to present the "greatest risk of deliberate misuse with significant potential for mass casualties or devastating effect to the economy, critical infrastructure, or public confidence, and pose a severe threat to public health and safety." The university blacked out the name of the bacteria in the records it released, but missed one reference to "B. pseudomallei."

The heat from boiling was supposed to deactivate the bacteria so it could be safely worked with in a lower-level lab where scientists don't wear respirators and the rooms lack negative air pressure and other special equipment designed to contain dangerous germs.

As a check to ensure the specimens had been sterilized, the worker put a sample from each tube into an incubator to see if the bacteria would grow, the records show. But rather than wait for the results of that safety check, which can take a day or more, the tubes were sent the same day to the lower-level lab at the same facility where another lab staffer – whose only safety gear noted in the report was a pair of gloves – transferred them to new tubes.

"Based on past experience that all samples prepared and tested this way over the last 6+ years had been sterile, DNA samples were presumed to be sterile, and brought out of the BSL-3 that afternoon," the incident report says. But on May 19, two of the 20 the supposedly sterile safety-check samples showed signs of growth. The lower-level lab was decontaminated. As a precaution, the researcher who had worked with the bacteria without proper protective gear received antibiotics for three weeks and never showed signs of infection, according to the records and university officials.

Earlier this summer the CDC in Atlanta also failed to confirm that anthrax spores had been deactivated before sending them to lower level labs at the agency – resulting in the potential exposure of dozens of workers to a particularly deadly strain of the bacteria discovered when growth was later seen on safety check plates. None have showed signs of infection. In June the CDC posted updated guidance to labs on its website about ensuring select agents are rendered inactive by using validated methods and safety checks.

Colorado State's vice president for research, Alan Rudolph, told USA TODAY that standard procedure was to ship Burkholderia samples out of the BSL-3 lab without confirmation of inactivation because the process had been 100% successful in the past. The lab now requires a 24- to 48-hour wait time to check for any growth, he said, and some researchers wait 48-72 hours "as an additional safety measure, but this is not mandated," he said.

Rudolph said it's a mystery why all the bacteria weren't deactivated in the May incident. "But we know this particular agent, Burkholderia pseudomallei, acts in unusual ways," he said, and that's one reason why it's important to study it so better tests and treatments can be developed against drug-resistant strains.

One of the university's top Burkholderia researchers, Herbert Schweizer, has said the "strict regulations imposed on researchers in the United States but not in other parts of the world" impedes genetic research into these select agent bacteria, according to a 2008 article he co-authored in an infectious disease journal. Schweizer, whose research is part of the NIH grant number cited in the incident report, was unavailable for comment, the university said.

"We have a great track record of safety," Rudolph said, noting that the university has worked safely for years with select agents. "This is an incident, as we reported, and we should learn from it."

About a week after the Burkholderia mishap, there was another serious incident at one of the university's high-containment labs experimenting with bacteria that cause tuberculosis. The May 28 incident was considered by the university's biosafety officer to be "a severe incident because it potentially put several others in jeopardy," according to the university's biosafety committee minutes for July.

Yet the researcher failed to mention the TB incident to the biosafety officer for about three weeks "because the individual was tired and forgot," the minutes say. "Once they were notified the BSO decontaminated the room" and sent e-mails to everyone who may have been exposed "during this time frame," the minutes say, noting that risks of infection were deemed minimal because of the use of protective gear by lab workers.

The minutes don't say what the researcher did wrong and the university blacked out information that identifies the incident as occurring in a TB lab.

Rudolph said the issue involved pus from a dead guinea pig getting outside of a special biosafety cabinet when a TB researcher was removing a lymph node from the animal. He said the interior and exterior of the cabinet were immediately disinfected but because of the nature of the incident "there was the possibility that the bacterium had been aerosolized."

"In research it's very difficult to envision a zero-risk environment," Rudolph said. The key, he said, is to balance working as safely as possible while still pursuing work that is critical to protecting public health.

St. Jude Children's Research Hospital

At St. Jude Children's Research Hospital in Memphis, which has an internationally recognized influenza research facility, a worker in an enhanced BSL-3 lab on May 12 discovered that five ferrets had escaped their cage. The ferrets had been inoculated a week earlier with the deadly H7N9 avian influenza virus but didn't show any symptoms, according to the hospital's incident report.

H7N9 is a strain of bird flu that in 2013 was first identified as having seriously sickened some people in China. Contact with infected poultry or contaminated environments is believed to be the source of most H7N9 infections in people, according to the CDC, but there has been limited spread of the virus from person-to-person in rare instances. Most people sickened by the strain have suffered severe respiratory illness and about one-third have died.

As the worker at St. Jude corralled the ferrets and put them back in their cage, she noticed that she'd gotten a tear in the double gloves on her right hand, and she later found she had sustained a small cut to her index finger.

Although the occupational health physician concluded her risk of exposure to the H7N9 virus was "very low," the tech was offered a five-day course of an anti-viral drug and underwent blood tests to look for signs of infection and none were found. After reviewing the report filed by the lab, NIH wrote a letter saying the hospital responded appropriately to the incident. H7N9 is not among the pathogens on the federal government's select agent list.

According to the hospital's incident report, the H7N9 virus being used in the experiment was created through reverse genetics and "made to be the same as the wild type viral sequence with no introduced mutations." The research was being overseen by Richard Webby, according to the records, which did not redact his name or the names of pathogens.

In June, when St. Jude's biosafety committee reviewed the ferret escape incident, it also approved a new project proposed by Webby to do a controversial type of research that the minutes say has the "high likelihood of conferring enhancements" – in other words making more dangerous – strains of avian influenza virus that currently only have a low ability to produce disease.

"After assessment of the biosafety risks, the committee had no biosafety concerns" about Webby's proposed research and approved the project, the minutes say.

Hammond said the ferret escape incident would be even more concerning if it occurred with a lab-created strain that is engineered to be more dangerous because of the potential for an infected lab worker to spread it in the community. Such "gain of function" experiments, he notes, are highly controversial.

In August 2013, Webby was among nearly two-dozen co-signers of a letter in the journal Nature arguing that controversial experiments are urgently needed to see what changes in the genome of the H7N9 virus could make it more deadly so scientists can better understand its potential to cause a future pandemic among people if it were to mutate naturally.

Other scientists oppose the work as too dangerous and of limited value when balanced against what may be learned.

Officials from St. Jude declined to be interviewed and did not answer many of USA TODAY's questions. In an e-mailed statement, St. Jude said: "We have a robust biological safety program that meets and exceeds all federal standards." The hospital did not answer questions about Webby's new research project, but said: "The project has not been started at St. Jude."

Rocky Mountain Laboratories

Around 11 a.m. on May 16, scientists in one of Rocky Mountain Laboratories' biosafety level 4 labs in Hamilton, Mont., thought they had fully anesthetized several mouselike rodents called Mastomys.

The animals had been infected with a strain of Lassa virus 21 days earlier, according to the lab's incident report.

Lassa virus causes a type of hemorrhagic fever which has symptoms similar to Ebola, such as bleeding from the gums, eyes or nose, and repeated vomiting. According to the CDC, crude estimates are that about 100,000 to 300,000 people are infected with Lassa fever each year in West Africa and about 5,000 die from it. Lassa virus is considered by regulators to be a select agent.

Rocky Mountain Laboratories is operated by the National Institute of Allergy and Infectious Diseases, a division of NIH.

The space-suit clad scientist was reaching into the cage to remove a sedated mouse to undergo a procedure as part of research to understand the infectious process of Lassa fever virus. That's when another of the rodents jumped out of the cage, ran down the procedure table and dropped to the floor. It was last seen running behind the table, before it disappeared.

For "1-2 hours" the scientists in the bulky, pressurized protective suits searched for the mouse in and around the table and throughout the procedure corridor – but couldn't find it, records show.

Live traps containing food were placed around the room, a "Do Not Enter" sign was posted and the bottom of the door was barricaded to prevent escape, the records say. Staff were also instructed "to visually make eye contact with the floor surrounding the door to ensure the rodent did not attempt to leave the room as the door was opened/closed." Yet when scientists went back into the room at 3:30 p.m., they still couldn't find the rodent.

In the wild, Mastomys are considered a natural host of Lassa virus and once infected are able to shed the virus in their urine and droppings.

The next morning when staff entered the BSL-4 lab suite they captured the animal in the necropsy room, where dead animals are dissected. "The animal was disposed of," the records say, and surfaces were decontaminated in the animal procedure corridor, the necropsy room and a support room.

Lab officials didn't initially believe they needed to report the incident to the select agent program as a possible release, the incident report says. However CDC select agent officials told the federal lab it needed to be reported.

In a statement to USA TODAY, the agency that runs the lab said: "The animal could not exit the BSL-4 laboratory and, as expected, was found the following morning. At no time was there a hazard to other parts of the facility or to the surrounding community." It was the first time a rodent had escaped inside the maximum-containment lab, the agency said.

Because 21 days had passed since it was infected with Lassa virus, researchers believe it would have already cleared the animal's system and it would not have been shedding virus at the time of the escape. "Regardless, the risk of virus exposure to laboratory workers is extremely low because of the protective, positive-pressure suits they wear, all of which functioned properly during this incident," the agency said.

Despite such assurances from all the labs, some in Congress remain wary.

"It used to be we only had a few labs doing this very high level and risky research. Now we have them at places like St. Jude and academic research institutions like CSU and other places," said DeGette. "It appears none of these breaches have lead to any kind of infection. But it's only a matter of time."

Read USA TODAY's investigative coverage of bioterror lab safety and security issues at biolabs.usatoday.com.

Follow USA TODAY investigative reporter Alison Young on Twitter: @alisonannyoung