{"id":"F2008L00556","name":"National Health Security Regulations 2008","slug":"national-health-security-regulations-2008","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":"55 of 2008","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":119471,"registerId":"commonwealth-F2008L00556-current","compilationNumber":null,"startDate":"2026-04-03","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1—Preliminary","sortOrder":0},{"sectionNumber":"1.01","sectionType":"section","heading":"Name of Regulations","content":"#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.","sortOrder":1},{"sectionNumber":"1.02","sectionType":"section","heading":"Commencement","content":"#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.","sortOrder":2},{"sectionNumber":"1.03","sectionType":"section","heading":"Definitions","content":"#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.","sortOrder":3},{"sectionNumber":"Part 2","sectionType":"part","heading":"Public health surveillance","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":4},{"sectionNumber":"2.01","sectionType":"section","heading":"Prescribed intelligence agencies","content":"#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.","sortOrder":5},{"sectionNumber":"Part 3","sectionType":"part","heading":"Regulation of security‑sensitive biological agents","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":6},{"sectionNumber":"Division 3.1","sectionType":"division","heading":"National Register","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":7},{"sectionNumber":"3.01","sectionType":"section","heading":"Content of National Register","content":"#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.","sortOrder":8},{"sectionNumber":"Division 3.2","sectionType":"division","heading":"Exempt entities","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":9},{"sectionNumber":"3.02","sectionType":"section","heading":"Application of Division 3.2","content":"#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.","sortOrder":10},{"sectionNumber":"3.03","sectionType":"section","heading":"Law enforcement agencies","content":"#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.","sortOrder":11},{"sectionNumber":"3.04","sectionType":"section","heading":"Depot or warehouse licence holders","content":"#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.","sortOrder":12},{"sectionNumber":"3.05","sectionType":"section","heading":"Persons or animals affected by security‑sensitive biological agents","content":"#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.","sortOrder":13},{"sectionNumber":"3.06","sectionType":"section","heading":"Treatment of persons or animals affected by security‑sensitive biological agents","content":"#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.","sortOrder":14},{"sectionNumber":"3.07","sectionType":"section","heading":"Handling of human bodies","content":"#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.","sortOrder":15},{"sectionNumber":"3.08","sectionType":"section","heading":"Handling of mice to test for botulinum toxin","content":"#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.","sortOrder":16},{"sectionNumber":"Division 3.4","sectionType":"division","heading":"Reportable events—registered entities","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":17},{"sectionNumber":"Subdivision 3.4.1","sectionType":"subdivision","heading":"Unauthorised access","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":18},{"sectionNumber":"3.15","sectionType":"section","heading":"Unauthorised access","content":"#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.","sortOrder":19},{"sectionNumber":"Subdivision 3.4.2","sectionType":"subdivision","heading":"Reportable events","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":20},{"sectionNumber":"3.16","sectionType":"section","heading":"Application of Subdivision 3.4.2","content":"#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.","sortOrder":21},{"sectionNumber":"3.17","sectionType":"section","heading":"Transfer—SSBA successfully received","content":"#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.","sortOrder":22},{"sectionNumber":"3.18","sectionType":"section","heading":"Unsuccessful transfer of SSBA","content":"#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.","sortOrder":23},{"sectionNumber":"3.19","sectionType":"section","heading":"Transfer—SSBA not received","content":"#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.","sortOrder":24},{"sectionNumber":"3.20","sectionType":"section","heading":"Unauthorised handling etc","content":"#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.","sortOrder":25},{"sectionNumber":"3.21","sectionType":"section","heading":"Unauthorised access to sensitive information","content":"#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.","sortOrder":26},{"sectionNumber":"3.22","sectionType":"section","heading":"Attempt to steal SSBA","content":"#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.","sortOrder":27},{"sectionNumber":"3.23","sectionType":"section","heading":"Attempt to access or handle SSBA","content":"#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.","sortOrder":28},{"sectionNumber":"3.24","sectionType":"section","heading":"Attempt to access sensitive information","content":"#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.","sortOrder":29},{"sectionNumber":"3.25","sectionType":"section","heading":"Accidental release of SSBA","content":"#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.","sortOrder":30},{"sectionNumber":"3.26","sectionType":"section","heading":"Persons affected by a security‑sensitive biological agent","content":"#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.","sortOrder":31},{"sectionNumber":"3.27","sectionType":"section","heading":"Change in particulars","content":"#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.","sortOrder":32},{"sectionNumber":"Subdivision 3.4.3","sectionType":"subdivision","heading":"Reportable events—when report must be given","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":33},{"sectionNumber":"3.40","sectionType":"section","heading":"Overview of Subdivision","content":"#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.","sortOrder":34},{"sectionNumber":"3.41","sectionType":"section","heading":"Handling SSBA","content":"#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.","sortOrder":35},{"sectionNumber":"3.42","sectionType":"section","heading":"Transfer or disposal of SSBA","content":"#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.","sortOrder":36},{"sectionNumber":"3.43","sectionType":"section","heading":"Unsuccessful transfer","content":"#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).","sortOrder":37},{"sectionNumber":"3.44","sectionType":"section","heading":"Loss, theft and unauthorised access etc","content":"#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.","sortOrder":38},{"sectionNumber":"3.45","sectionType":"section","heading":"Change in particulars","content":"#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.","sortOrder":39},{"sectionNumber":"3.45A Events that must be reported to po","sectionType":"section","heading":"3.45A Events that must be reported to police","content":"#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.","sortOrder":40},{"sectionNumber":"3.45B Period for reporting reportable ev","sectionType":"section","heading":"3.45B Period for reporting reportable events to police","content":"#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.","sortOrder":41},{"sectionNumber":"Division 3.5","sectionType":"division","heading":"Reportable events—entities that temporarily handle SSBA","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":42},{"sectionNumber":"3.46","sectionType":"section","heading":"Unauthorised access","content":"#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.","sortOrder":43},{"sectionNumber":"Division 3.7","sectionType":"division","heading":"Miscellaneous","content":"## Part 1—Preliminary\n\n#### 1.01 Name of Regulations\n\n  These Regulations are the National Health Security Regulations 2008.\n\n#### 1.02 Commencement\n\n  These Regulations commence on the day after they are registered.\n\n#### 1.03 Definitions\n\n  (1) In these Regulations:\n\n> Act means the National Health Security Act 2007.\n\n> affected has the meaning given by subregulation (2).\n\n> sensitive information, for a security‑sensitive biological agent an entity handles at a facility, means any of the following:\n\n    (a) the entity’s storage records for the security‑sensitive biological agent handled at the facility;\n    (b) an entity’s risk assessment plan for the security‑sensitive biological agent handled at the facility;\n    (c) an entity’s risk management plan for the security‑sensitive biological agent handled at the facility;\n    (d) any other information that the entity identifies as being sensitive information under Part 5 of the SSBA Standards because it could compromise the security of the security‑sensitive biological agent handled at the facility.\n  (2) The body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n## Part 2—Public health surveillance\n\n#### 2.01 Prescribed intelligence agencies\n\n  For paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n    (a) Australian Security Intelligence Organisation;\n    (b) Australian Federal Police.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 3.1—National Register\n\n#### 3.01 Content of National Register\n\n  For paragraph 37(f) of the Act, the following particulars are prescribed:\n    (a) if an entity is located in a place other than a facility where the entity handles security‑sensitive biological agents:\n    (i) the address of the place at which the entity is located; and\n    (ii) the entity’s postal address;\n    (b) the entity’s contact telephone number, fax number and email address;\n    (c) if the entity has an ABN, ACN or ARBN—those details;\n    (d) for each facility of the entity:\n    (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n    (ii) the fax number;\n    (e) for each facility of the entity—the name, contact telephone number, after hours contact telephone number, and email address at the facility, of:\n    (i) the person who is the responsible officer (within the meaning of the SSBA Standards) for the facility; and\n    (ii) the person who is the deputy responsible officer (within the meaning of the SSBA Standards) for the facility;\n    (f) if the Secretary decides to vary the National Register temporarily to take account of a reportable event mentioned in paragraph 48(1)(a) or subparagraph 48(1)(d)(i) of the Act—a statement to that effect.\n    (g) if the Secretary decides to vary the National Register to take account of a reportable event for the entity under subsection 49(1) of the Act—details of the reportable event;\n\n> Note: The Geocentric Datum of Australia 1994 was published in Gazette No. GN35 of 6 September 1995.\n\n### Division 3.2—Exempt entities\n\n#### 3.02 Application of Division 3.2\n\n  For paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 3.03 Law enforcement agencies\n\n  (1) A law enforcement agency that handles a security‑sensitive biological agent is an exempt entity if it handles a security‑sensitive biological agent in the course of carrying out a function under a law of the Commonwealth, or of a State or Territory.\n  (2) However, the law enforcement agency is not an exempt entity if it handles the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n  (3) In this regulation:\n\n> law enforcement agency means:\n\n    (a) the Australian Federal Police; or\n    (b) a police force of a State or Territory; or\n    (c) the Department administered by the Minister administering Part XII of the Customs Act 1901; or\n    (d) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015.\n\n#### 3.04 Depot or warehouse licence holders\n\n  An entity that handles a security‑sensitive biological agent is an exempt entity if the entity:\n    (a) holds either a depot licence under section 77G of the Customs Act 1901 or a warehouse licence under section 79 of that Act; and\n    (b) handles the security‑sensitive biological agent in accordance with the licence.\n\n#### 3.05 Persons or animals affected by security‑sensitive biological agents\n\n  (1) A person who is affected by a security‑sensitive biological agent is an exempt entity while affected by the security‑sensitive biological agent.\n  (2) An entity is an exempt entity if:\n    (a) the entity destroys an animal that is affected by a security‑sensitive biological agent; and\n    (b) the entity’s destruction of the animal is carried out because the animal is affected by a security‑sensitive biological agent.\n\n#### 3.06 Treatment of persons or animals affected by security‑sensitive biological agents\n\n  An entity is an exempt entity if:\n    (a) the entity provides treatment to a person who, or an animal that, has been affected by a security‑sensitive biological agent; and\n    (b) the entity handles the security‑sensitive biological agent:\n    (i) while the security‑sensitive biological agent is in the body of the person or the animal; or\n    (ii) while taking a sample from the person or the animal for the purposes of the treatment.\n\n#### 3.07 Handling of human bodies\n\n  An entity is an exempt entity for the purpose of examining, burying or cremating human bodies if:\n    (a) the functions of the entity include:\n    (i) examination, identification, storage or transport of the bodies of deceased persons; or\n    (ii) preparation of the bodies of deceased persons for burial or cremation; and\n    (b) the entity performs any of the functions mentioned in paragraph (a) on the body of a person who, before his or her death, was affected by a security‑sensitive biological agent.\n\n#### 3.08 Handling of mice to test for botulinum toxin\n\n  (1) An entity is an exempt entity for the purpose of handling mice to test for the presence of botulinum toxin if:\n    (a) the entity has functions that include the use of mice to test for the presence of botulinum toxin; and\n    (b) the entity conducts a test on mice for the presence of botulinum toxin.\n  (2) However, an entity is not an exempt entity if it handles botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3.4—Reportable events—registered entities\n\n#### Subdivision 3.4.1—Unauthorised access\n\n#### 3.15 Unauthorised access\n\n  (1) For paragraph 48(1)(g) of the Act, access to a security‑sensitive biological agent is unauthorised if:\n    (a) a person at a facility of a registered entity enters a place where a security‑sensitive biological agent is handled; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to enter the place—the person enters the place not in accordance with the approval.\n\n#### Subdivision 3.4.2—Reportable events\n\n#### 3.16 Application of Subdivision 3.4.2\n\n  For paragraph 48(1)(h) of the Act, this Subdivision prescribes events to be reportable events.\n\n#### 3.17 Transfer—SSBA successfully received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity transfers the security‑sensitive biological agent to:\n    (i) another facility of the entity; or\n    (ii) another registered entity (the receiving entity); and\n    (c) the receiving entity, or the entity in relation to its other facility, verifies, in accordance with Part 6 of the SSBA Standards, that the security‑sensitive biological agent has been received by the receiving entity or at the other facility.\n  (2) The event mentioned in paragraph (1)(c) is a reportable event for:\n    (a) if the security‑sensitive biological agent is transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is transferred to another facility of the entity—the entity in relation to the other facility.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(e) of the Act.\n\n#### 3.18 Unsuccessful transfer of SSBA\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another entity (whether or not registered) (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the receiving entity, or the entity in relation to its other facility, is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport to it of the security‑sensitive biological agent is successful.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity and that entity is registered—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities:\n    (i) the entity in relation to its other facility; and\n    (ii) the entity in relation to the facility from which the security‑sensitive biological agent is transferred.\n\n> Note: For the obligations of an unregistered entity, see subsection 42(1) of the Act.\n\n#### 3.19 Transfer—SSBA not received\n\n  (1) Subregulation (2) applies if:\n    (a) an entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n    (b) the entity enters into an arrangement:\n    (i) for another facility of the entity; or\n    (ii) with another registered entity (the receiving entity); and\n    (c) the arrangement concerns the transfer of the security‑sensitive biological agent to the receiving entity or the other facility; and\n    (d) the security‑sensitive biological agent is not received by the receiving entity or at the other facility at the time notified, in accordance with Part 6 of the SSBA Standards, by the entity transferring the security‑sensitive biological agent.\n  (2) The event mentioned in paragraph (1)(d) is a reportable event for:\n    (a) if the security‑sensitive biological agent is being transferred to another entity—the receiving entity; or\n    (b) if the security‑sensitive biological agent is being transferred to another of the entity’s facilities—the entity in relation to the other facility of the entity.\n\n> Note: The event mentioned in paragraph (1)(d) is a reportable event, for the entity that transfers a security‑sensitive biological agent, under paragraph 48(1)(f) of the Act.\n\n#### 3.20 Unauthorised handling etc\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity handles a security‑sensitive biological agent that is included on the National Register in relation to the entity and that facility; and\n    (b) subregulation (2) applies to the person.\n  (2) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (ii) not approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or\n    (b) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the authorisation; or\n    (c) if the person holds an approval, issued by the entity under Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility—the person handles the security‑sensitive biological agent not in accordance with the approval.\n\n#### 3.21 Unauthorised access to sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person at a facility of the entity accesses information about a security‑sensitive biological agent handled by the entity at the facility; and\n    (b) the information is sensitive information; and\n    (c) the person:\n    (i) is not authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—accesses the information not in accordance with the authorisation.\n\n> Note: Sensitive information is defined in regulation 1.03.\n\n#### 3.22 Attempt to steal SSBA\n\n  It is a reportable event for a registered entity if there has been an attempted theft, at a facility of the entity, of a security‑sensitive biological agent that the entity handles at the facility.\n\n#### 3.23 Attempt to access or handle SSBA\n\n  (1) It is a reportable event for a registered entity if:\n    (a) a person attempts to access a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) access to the security‑sensitive biological agent by the person at the facility is unauthorised.\n\n> Note: See regulation 3.15 for when access to a security‑sensitive biological agent is unauthorised.\n\n  (2) It is a reportable event for a registered entity if:\n    (a) a person attempts to handle a security‑sensitive biological agent that the entity handles at a facility; and\n    (b) subregulation (3) applies to the person.\n  (3) This subregulation applies if:\n    (a) the person is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) not approved by the entity in accordance with Part 3 of the SSBA Standards; or\n    (b) if handling by the person is authorised by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the authorisation; or\n    (c) if handling by the person is approved by the entity under Part 3 of the SSBA Standards—the person’s attempt is not in accordance with the approval.\n\n#### 3.24 Attempt to access sensitive information\n\n  It is a reportable event for a registered entity if:\n    (a) a person attempts to access sensitive information about a security‑sensitive biological agent handled by the entity at a facility; and\n    (b) access to the information by the person at the facility is:\n    (i) not authorised by the entity in accordance with Part 3 of the SSBA Standards; or\n    (ii) if the person holds an authorisation, issued by the entity under Part 3 of the SSBA Standards, to access the information—attempted by the person not in accordance with the authorisation.\n\n#### 3.25 Accidental release of SSBA\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) the security‑sensitive biological agent is accidentally released during its handling by a person at the facility.\n\n#### 3.26 Persons affected by a security‑sensitive biological agent\n\n  It is a reportable event for a registered entity if:\n    (a) a security‑sensitive biological agent is included on the National Register in relation to the entity and a facility; and\n    (b) a person who has been to the facility is affected by a security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility.\n\n#### 3.27 Change in particulars\n\n  (1) It is a reportable event for a registered entity if there are any of the following changes:\n    (a) a change to the entity’s name;\n    (b) if the entity is located in a place other than a facility where the entity handles a security‑sensitive biological agent:\n    (i) a change to the location of the entity; or\n    (ii) a change to the entity’s postal address;\n    (c) a change to the entity’s contact telephone number, fax number or email address;\n    (d) a change to the entity’s ABN, ACN or ARBN.\n  (2) It is a reportable event for a registered entity if there are any of the following changes for a facility of the entity:\n    (a) a change to the name, location or fax number of the facility;\n    (b) a change to the contact telephone number, after hours contact telephone number, or email address at the facility, of the responsible officer or the deputy responsible officer;\n    (c) a person who is the responsible officer for the facility ceases to be the responsible officer;\n    (d) a person who is the deputy responsible officer for the facility ceases to be the deputy responsible officer;\n    (e) the appointment of a person as the responsible officer or the deputy responsible officer for the facility.\n\n#### Subdivision 3.4.3—Reportable events—when report must be given\n\n#### 3.40 Overview of Subdivision\n\n  For subsection 48(3) of the Act, this Subdivision prescribes the period within which a report about a reportable event must be given by an entity to the Secretary.\n\n#### 3.41 Handling SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the entity starts to handle the security‑sensitive biological agent:\n    (a) a reportable event mentioned in paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent);\n    (b) a reportable event mentioned in subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register).\n  (2) An entity must report a reportable event mentioned in subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register) within 2 business days after the entity stops handling the security‑sensitive biological agent.\n\n#### 3.42 Transfer or disposal of SSBA\n\n  (1) An entity must report the following reportable events within 2 business days after the event takes place:\n    (a) a reportable event mentioned in paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent);\n    (b) a reportable event mentioned in paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity);\n    (c) a reportable event mentioned in paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.17 (transferred security‑sensitive biological agent received) within 2 business days:\n    (a) for the receiving entity—after the entity verifies that it has received the security‑sensitive biological agent; and\n    (b) for the entity transferring a security‑sensitive biological agent to another of its facilities—after the entity verifies, at the facility, that it has received the security‑sensitive biological agent.\n\n#### 3.43 Unsuccessful transfer\n\n  An entity must report a reportable event mentioned in regulation 3.18 (unsuccessful transfer of a security‑sensitive biological agent) within 2 business days:\n    (a) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the receiving entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after it is unable to verify at the facility that the transport of the security‑sensitive biological agent is successful; and\n    (b) for the receiving entity—after the entity is unable to verify that the transport to it of a security‑sensitive biological agent is successful.\n\n> Note: Verification, of a successful transport of a security‑sensitive biological agent, is provided for under Part 6 of the SSBA Standards: see paragraph 3.18(1)(d).\n\n#### 3.44 Loss, theft and unauthorised access etc\n\n  (1) An entity must report the following reportable events within 2 business days after the entity becomes aware of the event:\n    (a) a reportable event mentioned in paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen);\n    (b) a reportable event mentioned in paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent);\n    (c) a reportable event mentioned in regulation 3.20 (unauthorised handling of a security‑sensitive biological agent);\n    (d) a reportable event mentioned in regulation 3.21 (unauthorised access to sensitive information);\n    (e) a reportable event mentioned in regulation 3.22 (attempted theft of a security‑sensitive biological agent);\n    (f) a reportable event mentioned in subregulation 3.23(1) (attempt to access a security‑sensitive biological agent);\n    (g) a reportable event mentioned in subregulation 3.23(2) (attempt to handle a security‑sensitive biological agent);\n    (h) a reportable event mentioned in regulation 3.24 (attempt to access sensitive information);\n    (i) a reportable event mentioned in regulation 3.25 (accidental release of a security‑sensitive biological agent);\n    (j) a reportable event mentioned in regulation 3.26 (persons affected by a security‑sensitive biological agent).\n  (2) An entity must report a reportable event mentioned in regulation 3.19 (transferred security‑sensitive biological agent not received) within 2 business days:\n    (a) for the receiving entity—after the entity becomes aware that the transferred security‑sensitive biological agent is lost in transit; or\n    (b) for the entity transferring the security‑sensitive biological agent:\n    (i) after the entity becomes aware that the security‑sensitive biological agent transported to another entity is lost in transit; and\n    (ii) if the entity is transferring the security‑sensitive biological agent to another of its facilities—after the entity becomes aware, at the facility, that the security‑sensitive biological agent is lost in transit.\n\n> Note: A security‑sensitive biological agent that an entity attempts to transfer, and that is subsequently lost in transit, is reportable by the entity transferring the security‑sensitive biological agent under paragraph 48(1)(f) of the Act.\n\n#### 3.45 Change in particulars\n\n  An entity must report a reportable event that is mentioned in subregulation 3.27(1) or (2) within 2 business days after the event takes place.\n\n#### 3.45A Events that must be reported to police\n\n  For section 48A of the Act, the following events are prescribed:\n    (a) unauthorised access to a security‑sensitive biological agent, within the meaning of regulation 3.15;\n    (b) the event mentioned in paragraph 3.18(1)(d);\n    (c) the event mentioned in paragraph 3.19(1)(d);\n    (d) the event mentioned in subregulation 3.20(1);\n    (e) the event mentioned in regulation 3.21;\n    (f) the event mentioned in regulation 3.22;\n    (g) the event mentioned in subregulation 3.23(1);\n    (h) the event mentioned in subregulation 3.23(2);\n    (i) the event mentioned in regulation 3.24.\n\n#### 3.45B Period for reporting reportable events to police\n\n  For subsection 48A(3) of the Act, the period is the period ending 24 hours after the registered entity became aware that the reportable event had occurred.\n\n### Division 3.5—Reportable events—entities that temporarily handle SSBA\n\n#### 3.46 Unauthorised access\n\n  For subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n### Division 3.7—Miscellaneous\n\n#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":44},{"sectionNumber":"3.70","sectionType":"section","heading":"Identity cards","content":"#### 3.70 Identity cards\n\n  For paragraph 64(2)(a) of the Act, an identity card issued to an inspector must be in a form that contains the following information:\n    (a) the full name of the inspector;\n    (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n    (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n    (d) the date the card was issued;\n    (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.","sortOrder":45},{"sectionNumber":"3.71","sectionType":"section","heading":"Confidentiality of information","content":"#### 3.71 Confidentiality of information\n\n  Intelligence agency\n  (1) For paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n  Law enforcement agencies\n  (2) For paragraph 85(1)(b) of the Act, the following agencies are prescribed:\n    (a) the Australian Federal Police;\n    (b) the police force of each of the States and Territories.\n\n> Note: The Australian Federal Police operates the Australian Chemical, Biological, Radiological and Nuclear Data Centre.","sortOrder":46}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":1958},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"The regulations implement the specific operational framework established by the National Health Security Act 2007. They provide detailed administrative requirements for the SSBA regulatory scheme (registration, reporting, exemptions) without expanding beyond the Act's original purpose of securing dangerous biological agents."},"complexity_factors":["Heavy cross-referencing to the parent National Health Security Act 2007 and external SSBA Standards","Nested conditional exemptions with specific exceptions (e.g., law enforcement exempt unless using agents as 'control samples' for testing)","Multiple reporting timeframes depending on event type (2 business days vs 24 hours for police)","Technical defined terms including 'affected' (introduced into the body) and 'sensitive information'","Requirement for precise geographic coordinates using Geocentric Datum of Australia 1994","Complex transfer verification requirements distinguishing between successful, unsuccessful, and non-received transfers"],"plain_english_summary":"These regulations set practical rules for handling security‑sensitive biological agents (deadly pathogens/toxins) under the National Health Security Act 2007. They require entities working with such agents to register, report key events (work starts/stops, transfers, losses, exposures) to government—usually within 2 business days—and notify police of serious security incidents within 24 hours. The rules specify inspector identity cards and allow sharing of sensitive information with ASIO and police for security purposes, with some specified exemptions from registration."}},"importantCases":[],"_links":{"self":"/api/acts/national-health-security-regulations-2008","history":"/api/acts/national-health-security-regulations-2008/history","analysis":"/api/acts/national-health-security-regulations-2008/analysis","conflicts":"/api/acts/national-health-security-regulations-2008/conflicts","importantCases":"/api/acts/national-health-security-regulations-2008/important-cases","documents":"/api/acts/national-health-security-regulations-2008/documents"}}