{"id":"F2018L01247","name":"National Health Security Regulations 2018","slug":"national-health-security-regulations-2018","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":97921,"registerId":"commonwealth-F2018L01247-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1—Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name","content":"#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.","sortOrder":1},{"sectionNumber":"3","sectionType":"section","heading":"Authority","content":"#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.","sortOrder":2},{"sectionNumber":"5","sectionType":"section","heading":"Definitions","content":"#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.","sortOrder":3},{"sectionNumber":"Part 2","sectionType":"part","heading":"Public health surveillance","content":"## Part 2—Public health surveillance","sortOrder":4},{"sectionNumber":"6","sectionType":"section","heading":"Prescribed intelligence agencies","content":"#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.","sortOrder":5},{"sectionNumber":"Part 3","sectionType":"part","heading":"Regulation of security‑sensitive biological agents","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":6},{"sectionNumber":"Division 1","sectionType":"division","heading":"The National Register","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":7},{"sectionNumber":"7","sectionType":"section","heading":"Content of National Register","content":"#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.","sortOrder":8},{"sectionNumber":"Division 2","sectionType":"division","heading":"Exempt entities","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":9},{"sectionNumber":"8","sectionType":"section","heading":"Purposes of this Division","content":"#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.","sortOrder":10},{"sectionNumber":"9","sectionType":"section","heading":"Law enforcement agencies","content":"#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.","sortOrder":11},{"sectionNumber":"10","sectionType":"section","heading":"Depot and warehouse licence holders","content":"#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.","sortOrder":12},{"sectionNumber":"11","sectionType":"section","heading":"Persons and animals affected by security‑sensitive biological agents","content":"#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.","sortOrder":13},{"sectionNumber":"12","sectionType":"section","heading":"Handling of mice to test for botulinum toxin","content":"#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.","sortOrder":14},{"sectionNumber":"Division 3","sectionType":"division","heading":"Reportable events for registered entities","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":15},{"sectionNumber":"Subdivision A","sectionType":"subdivision","heading":"Unauthorised access","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":16},{"sectionNumber":"13","sectionType":"section","heading":"Unauthorised access","content":"#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.","sortOrder":17},{"sectionNumber":"Subdivision B","sectionType":"subdivision","heading":"Other reportable events","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":18},{"sectionNumber":"14","sectionType":"section","heading":"Purposes of this Subdivision","content":"#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.","sortOrder":19},{"sectionNumber":"15","sectionType":"section","heading":"Transfers of SSBAs—successful transfers","content":"#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.","sortOrder":20},{"sectionNumber":"16","sectionType":"section","heading":"Transfers of SSBAs—unsuccessful transfers","content":"#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.","sortOrder":21},{"sectionNumber":"17","sectionType":"section","heading":"Transfers of SSBAs—SSBAs not received by expected time of delivery","content":"#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.","sortOrder":22},{"sectionNumber":"18","sectionType":"section","heading":"Unauthorised handling etc.","content":"#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```","sortOrder":23},{"sectionNumber":"19","sectionType":"section","heading":"Changes in particulars","content":"#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.","sortOrder":24},{"sectionNumber":"Subdivision C","sectionType":"subdivision","heading":"When reports must be given","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":25},{"sectionNumber":"20","sectionType":"section","heading":"When reports must be given","content":"#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```","sortOrder":26},{"sectionNumber":"Subdivision D","sectionType":"subdivision","heading":"Events that must be reported to police","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":27},{"sectionNumber":"21","sectionType":"section","heading":"Events that must be reported to police","content":"#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.","sortOrder":28},{"sectionNumber":"Division 4","sectionType":"division","heading":"Reportable events for entities that temporarily handle SSBAs","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":29},{"sectionNumber":"22","sectionType":"section","heading":"Unauthorised access","content":"#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.","sortOrder":30},{"sectionNumber":"23","sectionType":"section","heading":"When reports must be given","content":"#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.","sortOrder":31},{"sectionNumber":"Division 5","sectionType":"division","heading":"Identity cards","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":32},{"sectionNumber":"24","sectionType":"section","heading":"Identity cards","content":"#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.","sortOrder":33},{"sectionNumber":"Division 6","sectionType":"division","heading":"Confidentiality of information","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the National Health Security Regulations 2018.\n\n#### 3 Authority\n\n This instrument is made under the National Health Security Act 2007.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) entity;\n (b) facility;\n (c) handling;\n (d) registered entity;\n (e) security‑sensitive biological agent;\n (f) SSBA;\n (g) SSBA Standards.\n In this instrument:\n\n> ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.\n\n> Note: ABN is short for Australian Business Number.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Note: ACN is short for Australian Company Number.\n\n> Act means the National Health Security Act 2007.\n\n> affected: the body of a person or animal is affected by a security‑sensitive biological agent if the security‑sensitive biological agent has been introduced into the body.\n\n> ARBN has the same meaning as in the Corporations Act 2001.\n\n> Note: ARBN is short for Australian Registered Body Number.\n\n> Deputy Responsible Officer has the same meaning as in the SSBA Standards.\n\n> Geocentric Datum of Australia 1994 means the Geocentric Datum of Australia as defined in Gazette No. GN 35 of 6 September 1995, as existing when this instrument commences.\n\n> law enforcement agency has the meaning given by subsection 9(2).\n\n> Responsible Officer has the same meaning as in the SSBA Standards.\n\n> sensitive information, in relation to a security‑sensitive biological agent that an entity handles at a facility, means any of the following:\n\n (a) the entity’s storage records for the agent;\n (b) the entity’s risk assessment plan for the agent;\n (c) the entity’s risk management plan for the agent;\n (d) any information:\n (i) that the entity holds; and\n (ii) disclosure of which could compromise the security of the agent.\n\n## Part 2—Public health surveillance\n\n#### 6 Prescribed intelligence agencies\n\n For the purposes of paragraph 23(2)(b) of the Act, each of the following intelligence agencies is prescribed:\n (a) the Australian Federal Police;\n (b) the Australian Security Intelligence Organisation.\n\n## Part 3—Regulation of security‑sensitive biological agents\n\n### Division 1—The National Register\n\n#### 7 Content of National Register\n\n For the purposes of paragraph 37(f) of the Act, the following particulars are prescribed in relation to an entity:\n (a) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents:\n (i) the address of the entity’s head office; and\n (ii) the entity’s postal address;\n (b) the entity’s telephone number, fax number and email address;\n (c) if the entity has an ABN, ACN or ARBN—those details;\n (d) for each facility where the entity handles security‑sensitive biological agents:\n (i) the geographic coordinates of the facility, expressed in terms of the Geocentric Datum of Australia 1994; and\n (ii) the fax number of the facility; and\n (iii) the name, telephone number, after hours telephone number and email address of the Responsible Officer for the facility; and\n (iv) the name, telephone number, after hours telephone number and email address of the Deputy Responsible Officer for the facility;\n (e) if the Secretary decides under section 49 of the Act to vary the National Register to take account of a reportable event in relation to the entity—details of the reportable event;\n (f) if the Secretary decides under subsection 52(2) of the Act to vary the National Register on a temporary basis to take account of a reportable event in relation to the entity:\n (i) details of the reportable event; and\n (ii) a statement that the variation is temporary.\n\n### Division 2—Exempt entities\n\n#### 8 Purposes of this Division\n\n For the purposes of paragraph 40(1)(b) of the Act, this Division prescribes entities to be exempt entities.\n\n#### 9 Law enforcement agencies\n\n (1) A law enforcement agency is an exempt entity in relation to a security‑sensitive biological agent if the agency:\n (a) handles the security‑sensitive biological agent only in the course of carrying out a function of the agency under a law of the Commonwealth, or of a State or Territory; and\n (b) does not handle the security‑sensitive biological agent for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n (2) Each of the following is a law enforcement agency:\n (a) the Australian Federal Police;\n (b) a police force of a State or Territory;\n (c) the Department administered by the Minister administering Part 1 of Chapter 8 of the Biosecurity Act 2015;\n (d) the Department administered by the Minister administering Part XII of the Customs Act 1901.\n\n#### 10 Depot and warehouse licence holders\n\n (1) An entity that holds:\n (a) a depot licence (within the meaning of Part IVA of the Customs Act 1901); or\n (b) a warehouse licence (within the meaning of Part V of that Act);\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with the licence.\n (2) An entity that is permitted or required to do something under:\n (a) paragraphs 77VA(2)(a) to (d) of the Customs Act 1901; or\n (b) paragraphs 86(7)(a) to (d) of that Act;\n is an exempt entity in relation to a security‑sensitive biological agent if the entity handles the security‑sensitive biological agent only in accordance with that permission or requirement.\n\n#### 11 Persons and animals affected by security‑sensitive biological agents\n\n Persons affected by security‑sensitive biological agents\n (1) A person who is affected by a security‑sensitive biological agent is an exempt entity in relation to that security‑sensitive biological agent while the person is affected by it.\n Providing treatment to affected persons or animals\n (2) An entity that provides treatment to a person or animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the person or animal is or has been affected by the security‑sensitive biological agent; and\n (b) the entity handles the security‑sensitive biological agent only while:\n (i) the security‑sensitive biological agent is in the body of the person or animal; or\n (ii) taking a sample from the person or animal for the purposes of the treatment.\n Destroying affected animals\n (3) An entity that destroys an animal is an exempt entity in relation to a security‑sensitive biological agent if:\n (a) the animal is affected by the security‑sensitive biological agent; and\n (b) the entity destroys the animal because the animal is affected by the security‑sensitive biological agent; and\n (c) the entity handles the security‑sensitive biological agent only in the course of destroying the animal.\n Handling of bodies of affected deceased persons\n (4) An entity that has the function of:\n (a) examining, identifying, storing, transporting, burying or cremating the bodies of deceased persons; or\n (b) preparing the bodies of deceased persons for burial or cremation;\n is an exempt entity in relation to a security‑sensitive biological agent if:\n (c) a deceased person was affected by the security‑sensitive biological agent before the person’s death; and\n (d) the entity handles the security‑sensitive biological agent only in the course of carrying out a function mentioned in paragraph (a) or (b) in relation to the person’s body.\n\n#### 12 Handling of mice to test for botulinum toxin\n\n An entity that has the function of handling mice to test for the presence of botulinum toxin is an exempt entity in relation to botulinum toxin if the entity:\n (a) handles the botulinum toxin only in the course of carrying out that function; and\n (b) does not handle the botulinum toxin for the purpose of using it as a control sample for testing or carrying out diagnostic analysis.\n\n### Division 3—Reportable events for registered entities\n\n#### Subdivision A—Unauthorised access\n\n#### 13 Unauthorised access\n\n (1) This section applies if:\n (a) a security‑sensitive biological agent is included in the National Register in relation to an entity and a facility; and\n (b) a person at the facility enters a place where the security‑sensitive biological agent is handled.\n (2) For the purposes of paragraph 48(1)(g) of the Act, access by the person to the security‑sensitive biological agent at that place is unauthorised if:\n (a) the person is neither:\n (i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; nor\n (ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to enter the place; or\n (b) the person is so authorised or approved, but the person enters the place other than in accordance with the authorisation or approval.\n\n#### Subdivision B—Other reportable events\n\n#### 14 Purposes of this Subdivision\n\n For the purposes of paragraph 48(1)(h) of the Act, this Subdivision prescribes events in relation to registered entities.\n\n#### 15 Transfers of SSBAs—successful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity verifies, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 16 Transfers of SSBAs—unsuccessful transfers\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity transfers the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the security‑sensitive biological agent is received at the other facility; and\n (d) the entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological agent to the other facility was successful.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note: The event mentioned in paragraph (1)(b) is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n Transfers to facilities of other entities\n (3) Subregulation (4) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity transfers the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the security‑sensitive biological agent is received at the receiving facility; and\n (e) the receiving entity is unable to verify, in accordance with Part 6 of the SSBA Standards, that the transport of the security‑sensitive biological to the receiving facility was successful.\n (4) The event mentioned in paragraph (3)(e) is a reportable event for the receiving entity.\n\n> Note: The event mentioned in paragraph (3)(c) is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n#### 17 Transfers of SSBAs—SSBAs not received by expected time of delivery\n\n Transfers to other facilities of same entity\n (1) Subregulation (2) applies if:\n (a) a registered entity is included on the National Register in relation to a facility and a security‑sensitive biological agent; and\n (b) the entity arranges for the transfer of the security‑sensitive biological agent from the facility to another facility of the entity; and\n (c) the entity notifies the other facility, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the other facility; and\n (d) the security‑sensitive biological agent is not received at the other facility by the notified expected time of delivery.\n (2) The event mentioned in paragraph (1)(d) is a reportable event for the entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the entity under subparagraph 48(1)(e)(ii) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the entity under paragraph 48(1)(f) of the Act.\n\n (3) Subsection (2) does not apply if:\n (a) the security‑sensitive agent is received at the other facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the entity knows that the security‑sensitive biological agent is not lost or stolen.\n Transfers to facilities of other entities\n (4) Subregulation (5) applies if:\n (a) a registered entity (the sending entity) is included on the National Register in relation to a facility (the sending facility) and a security‑sensitive biological agent; and\n (b) another registered entity (the receiving entity) is included on the National Register in relation to another facility (the receiving facility) and the same security‑sensitive biological agent; and\n (c) the sending entity arranges with the receiving entity for the transfer of the security‑sensitive biological agent from the sending facility to the receiving facility; and\n (d) the sending entity notifies the receiving entity, in accordance with Part 6 of the SSBA Standards, of the expected time of delivery of the security‑sensitive biological agent to the receiving facility; and\n (e) the security‑sensitive biological agent is not received at the receiving facility by the notified expected time of delivery.\n (5) The event mentioned in paragraph (4)(e) is a reportable event for the receiving entity.\n\n> Note 1: Transferring the security‑sensitive biological agent is a reportable event for the sending entity under subparagraph 48(1)(e)(i) of the Act.\n\n> Note 2: Loss or theft of the security‑sensitive biological agent is a reportable event for the sending entity under paragraph 48(1)(f) of the Act.\n\n (6) Subsection (5) does not apply if:\n (a) the security‑sensitive agent is received at the receiving facility within 2 business days after the notified expected time of delivery; and\n (b) at all times between the notified expected time of delivery and the receiving of the security‑sensitive biological agent, the receiving entity knows that the security‑sensitive biological agent is not lost or stolen.\n\n#### 18 Unauthorised handling etc.\n\n An event mentioned in column 1 of an item of the following table is prescribed in relation to a registered entity that is included on the National Register in relation to a facility and a security‑sensitive biological agent, if:\n (a) there are no circumstances mentioned in column 2 of the item; or\n (b) the circumstances mentioned in column 2 of the item exist.\n\n```html\n

Reportable events

Item

Column 1

Event

Column 2

Circumstances

1

a person handles the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the handling is not in accordance with the authorisation or approval

2

a person attempts to handle the security‑sensitive biological agent at the facility

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to handle the security‑sensitive biological agent at the facility; or

(b) the person is so authorised or approved, but the attempt is not in accordance with the authorisation or approval

3

a person attempts to access the security‑sensitive biological agent at the facility

the access is unauthorised under section 13

4

a person attempts to steal the security‑sensitive biological agent at the facility

none

5

the security‑sensitive biological agent is accidentally released during its handling at the facility

none

6

a person who has been to the facility is affected by the security‑sensitive biological agent as a result of the entity’s handling of the security‑sensitive biological agent at the facility

none

7

a person accesses sensitive information at the facility about the security‑sensitive biological agent

Note: For sensitive information, see section 5.

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

8

a person attempts to access sensitive information at the facility about the security‑sensitive biological agent

(a) the person is neither:

(i) authorised by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; nor

(ii) approved by the entity, in accordance with Part 3 of the SSBA Standards, to access the information; or

(b) the person is so authorised or approved, but the access is not in accordance with the authorisation or approval

\n```\n\n#### 19 Changes in particulars\n\n The following events are prescribed in relation to a registered entity:\n (a) a change to any of the following:\n (i) the entity’s name;\n (ii) if the entity’s head office is located at a place other than a facility where the entity handles security‑sensitive biological agents—the address of the entity’s head office, or the entity’s postal address;\n (iii) the entity’s telephone number, fax number or email address;\n (iv) the entity’s ABN, ACN or ARBN;\n (b) any of the following events in relation to a facility where the entity handles security‑sensitive biological agents:\n (i) a change to the name, location or fax number of the facility;\n (ii) a change to the telephone number, after hours telephone number or email address of the Responsible Officer or the Deputy Responsible Officer for the facility;\n (iii) the Responsible Officer for the facility ceases to be the Responsible Officer;\n (iv) the Deputy Responsible Officer for the facility ceases to be the Deputy Responsible Officer;\n (v) a Responsible Officer or Deputy Responsible Officer is appointed for the facility.\n\n#### Subdivision C—When reports must be given\n\n#### 20 When reports must be given\n\n For the purposes of subsection 48(3) of the Act, a registered entity that must give a report about a reportable event mentioned in column 1 of an item of the following table must give the report within the period mentioned in column 2 of the item.\n\n```html\n

When reports must be given

Item

Column 1

For a reportable event mentioned in …

Column 2

the report must be given within …

1

paragraph 48(1)(a) of the Act (entity starts to handle a security‑sensitive biological agent)

2 business days after the entity starts to handle the security‑sensitive biological agent.

2

(a) paragraph 48(1)(b) of the Act (entity disposes of its entire holdings of a security‑sensitive biological agent); or

(b) paragraph 48(1)(c) of the Act (disposal of toxins resulting in less than a reportable quantity)

2 business days after the event occurs.

3

subparagraph 48(1)(d)(i) of the Act (entity starts to handle a security‑sensitive biological agent for a purpose not specified in the National Register)

2 business days after the entity starts to handle the security‑sensitive biological agent for that purpose.

4

subparagraph 48(1)(d)(ii) of the Act (entity stops handling a security‑sensitive biological agent for a purpose specified in the National Register)

2 business days after the entity stops handling the security‑sensitive biological agent for that purpose.

5

paragraph 48(1)(e) of the Act (entity transfers a security‑sensitive biological agent)

2 business days after the event occurs.

6

(a) paragraph 48(1)(f) of the Act (security‑sensitive biological agent is lost or stolen); or

(b) paragraph 48(1)(g) of the Act (unauthorised access to a security‑sensitive biological agent)

2 business days after the entity becomes aware of the event.

7

section 15, 16 or 17 of this instrument (transfer of security‑sensitive biological agent)

2 business days after the event occurs.

8

section 18 of this instrument (unauthorised handling etc.)

2 business days after the entity becomes aware of the event.

9

section 19 of this instrument (change in particulars)

2 business days after the event occurs.

\n```\n\n#### Subdivision D—Events that must be reported to police\n\n#### 21 Events that must be reported to police\n\n (1) For the purposes of paragraph 48A(1)(b) of the Act, the following reportable events are prescribed:\n (a) the event mentioned in paragraph 48(1)(g) of the Act;\n (b) the event mentioned in subsection 16(2) or (4) of this instrument;\n (c) the event mentioned in subsection 17(2) or (5) of this instrument;\n (d) the event mentioned in column 1 of item 1, 2, 3, 4, 7 or 8 of the table in section 18 of this instrument.\n (2) For the purposes of subsection 48A(3) of the Act, the period is the period of 24 hours after the registered entity becomes aware of the event.\n\n### Division 4—Reportable events for entities that temporarily handle SSBAs\n\n#### 22 Unauthorised access\n\n For the purposes of subparagraph 60AF(1)(b)(ii) of the Act, access is unauthorised if the access does not comply with Part 10 of the SSBA Standards.\n\n#### 23 When reports must be given\n\n When reports must be given to Secretary\n (1) For the purposes of subsection 60AF(2) of the Act, the period is the period of 2 business days after the entity becomes aware of the event.\n When reports must be given to police\n (2) For the purposes of subsection 60AH(3) of the Act, the period is the period of 24 hours after the entity becomes aware of the event.\n\n### Division 5—Identity cards\n\n#### 24 Identity cards\n\n For the purposes of paragraph 64(2)(a) of the Act, an identity card issued to an inspector must contain the following:\n (a) the full name of the inspector;\n (b) a statement that the person to whom the card is issued is appointed under subsection 63(1) of the Act;\n (c) for the photograph required under paragraph 64(2)(b) of the Act, an image showing the inspector’s full face, head and shoulders;\n (d) the date the card was issued;\n (e) the date the card expires.\n\n> Note: Paragraph 64(2)(b) of the Act provides that an identity card issued to an inspector must contain a recent photograph of the inspector.\n\n### Division 6—Confidentiality of information\n\n#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":34},{"sectionNumber":"25","sectionType":"section","heading":"Confidentiality of information","content":"#### 25 Confidentiality of information\n\n Intelligence agency\n (1) For the purposes of paragraph 85(1)(a) of the Act, the Australian Security Intelligence Organisation is prescribed.\n Law enforcement agencies\n (2) For the purposes of paragraph 85(1)(b) of the Act, the following law enforcement agencies are prescribed:\n (a) the Australian Federal Police;\n (b) the police force of a State or Territory.","sortOrder":35}],"analysis":{"kimi_summary":{"_metrics":{"completionTokens":714},"content_quality":"ok","complexity_score":7,"scope_assessment":{"changed":false,"description":"The regulations appear to implement the intended scope of the parent Act without significant expansion. They provide necessary operational detail for the National Register, exemptions, and reporting framework as contemplated by the Act's structure."},"complexity_factors":["Extensive cross-referencing to the parent Act (National Health Security Act 2007) and external standards (SSBA Standards)","Multiple nested conditional exemptions with precise scope limitations (e.g., law enforcement only exempt when handling 'in course of carrying out a function' and not for control samples)","Detailed tabular reporting requirements with 9 distinct event categories and varying timeframes","Bifurcated reporting obligations: 2 business days to Secretary vs 24 hours to police depending on event severity","Complex transfer rules distinguishing between intra-entity and inter-entity transfers, successful vs unsuccessful verification, and late delivery exceptions","Defined terms imported from multiple external statutes (ABN from tax law, ACN/ARBN from Corporations Act, customs licence terms from Customs Act)","Geographic coordinate requirements tied to a specific datum (Geocentric Datum of Australia 1994)","Dual officer structure (Responsible Officer and Deputy Responsible Officer) with specific contact detail requirements"],"plain_english_summary":"These regulations establish a national system to track and secure high‑risk biological agents by requiring facilities that handle them to register, report key activities and incidents quickly, and allow authorities controlled access to sensitive information. They apply to labs, temporary handlers and other entities that manage these materials while carving out practical exemptions for frontline clinical, veterinary and certain enforcement activities. The goal is to reduce the risk of misuse or theft of dangerous pathogens while preserving legitimate medical and scientific work."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":false,"description":"These Regulations operationalise and elaborate provisions of the National Health Security Act 2007 (they prescribe definitions, reporting categories, timings, exemptions and register particulars). They do not add new substantive powers beyond the Act but fill in procedural detail (eg, which data appear on the National Register, what counts as unauthorised access, precise reporting deadlines, and which agencies receive confidential information). In that sense the Regulations implement the Act rather than change or broaden its statutory scope."},"complexity_factors":["Heavy cross‑referencing to the National Health Security Act 2007 (eg paragraphs/sections 23, 37, 40, 48, 48A, 49, 52, 60AF, 60AH) throughout the Regulations","Frequent delegation to the SSBA Standards (multiple Parts referenced for authorisations, approvals, transport verification and access rules) creating external dependency","Multiple categories of reportable events with nested conditions and exceptions (regs 13–18 and table entries), including successful/unsuccessful/late transfers and unauthorised handling/access","Two separate reporting timeframes to different recipients (2 business days to the Secretary; 24 hours to police for specified events) with event‑specific triggers (regs 20, 21, 23)","Several narrow exemptions with conditional language (law enforcement, depot/warehouse licence holders, treatment of affected persons/animals, botulinum mouse testing) that require fact‑specific application (regs 9–12)","Secretary discretion to vary the National Register permanently or temporarily to record reportable events (reg 7(e)–(f) with Act cross‑references)","Technical requirements (eg geographic coordinates, after‑hours contacts, Responsible Officer details) that impose precise data capture and recordkeeping (reg 7)","Duplicative and repeated drafting in the instrument increases navigational and drafting complexity for readers (the text repeats parts multiple times)","Confidentiality provisions prescribing particular intelligence and law enforcement recipients (reg 25) that interact with privacy/security governance"],"plain_english_summary":"**What this instrument does (mechanics)\n\n- Sets out detailed rules that put the National Health Security Act 2007 into practical effect for the handling, recording and reporting of \"security‑sensitive biological agents\" (SSBAs). Key regulatory actions include: (a) the particulars that must appear on the National Register (regulation 7); (b) which organisations or circumstances are exempt from SSBA rules (regs 8–12); (c) the catalogue of \"reportable events\" that registered entities and temporary handlers must notify (regs 13–21, 15–18); (d) deadlines for giving reports to the Secretary and, for certain events, to the police (reg 20; regs 21, 23); (e) what an inspector's identity card must show (reg 24); and (f) which agencies may receive confidential SSBA information (reg 25). The Regulations repeatedly rely on procedural requirements in the SSBA Standards (for example, authorisations to enter or handle material, and transport verification under Part 6 of the SSBA Standards).\n\n**Who it affects**\n\n- Registered entities and other bodies that handle SSBAs at facilities (research labs, clinical labs, biotech firms, veterinary labs, etc.). See the rules about National Register particulars (reg 7) and reportable events (regs 13–19).\n- Entities that only temporarily handle SSBAs (they have parallel reporting duties; regs 22–23).\n- Responsible Officers and Deputy Responsible Officers for each facility (their names and contact details must be recorded; reg 7(d)(iii)–(iv)).\n- Law enforcement and certain government departments (specific exemptions are provided; regs 9–10; reg 25 prescribes who receives confidential information).\n- Inspectors appointed under the Act (identity card content prescribed; reg 24).\n\n**Why it matters (practical effect)**\n\n- It operationalises surveillance and security controls over dangerous biological agents by: (a) forcing operators to register facilities and contact points; (b) requiring short reporting windows for loss, theft, unauthorised access, certain transfer problems and other incidents; and (c) prescribing who may receive sensitive information.\n\n**Stated purpose and how the Regulations produce it**\n\n- The instrument implements the Act's objective of tracking and securing SSBAs by creating a national register, defining reportable events and fixing reporting timelines. Concretely, it aims to make incidents visible to the Secretary and, in specified cases, to police (regs 20–21). The Regulations rely on technical requirements in the SSBA Standards (for authorisations, approvals, transport verification and access controls). Those external technical standards determine operational compliance in many places (see regs 13 and 15–17).\n\n**Costs, incentives and trade‑offs (concrete mechanisms)**\n\n- Who pays: the compliance cost falls on entities that handle SSBAs. They must maintain records, report events within tight deadlines (mostly 2 business days to the Secretary; 24 hours to police for a subset), and meet SSBA Standards for authorisation, transfer verification and access control (reg 20; regs 21, 23; regs 13, 15–17).\n- Administrative burden: the Regulations require registrants to record facility geo‑coordinates, multiple contact points and Responsible Officer details (reg 7(d)), to verify transport under Part 6 of the SSBA Standards (regs 15–17), and to report a wide set of incidents (reg 18 table). Smaller labs that transfer SSBAs or that run animal testing (botulinum mouse testing exemption is narrow; reg 12) will need procedures and personnel time to comply.\n- Incentives: short reporting windows create an incentive to build internal detection and communication procedures and to appoint Responsible Officers and Deputies with after‑hours contacts (reg 7(d)(iii)–(iv), reg 20). They also create an incentive to use licensed depots/warehouses or authorised transport processes to stay within exemptions (reg 10).\n- Trade‑offs: the Regulations increase oversight and situational awareness for the Secretary and law enforcement at the cost of added operational overhead for private and public labs. Exemptions (regs 9–12) reduce burden for law enforcement and certain licensed handlers but are narrowly framed (for example, agencies must not handle SSBAs as control samples if they wish to claim the exemption (reg 9(1)(b))).\n- Bureaucratic discretion: the Secretary can vary the National Register to record reportable events and can make temporary variations (reg 7(e)–(f); cross‑reference to sections 49 and 52 of the Act). That creates operational discretion over what the public record shows and how long temporary notations remain.\n\n**Implementation risks and operational friction**\n\n- Cross‑dependency on SSBA Standards: many obligations are implemented by reference to those Standards (eg, authorisations, approvals, transport verification). If the Standards change, regulated entities must adapt, and the Regulations’ effect depends on timely and clear Standards documents (see regs 13, 15–17, 22).\n- Ambiguity and interpretation: the instrument frequently cross‑references statutory provisions and the SSBA Standards; differing interpretations of when an event becomes \"reportable\" or \"verified\" may lead to inconsistent reporting and either over‑ or under‑reporting.\n- Data confidentiality and sharing: the National Register and report notifications collect sensitive contact and operational information (reg 7). Reg 25 prescribes which agencies receive confidential information (ASIO and police), but the Regulations require systems and governance to protect that data, and mishandling risk creates legal and reputational exposure.\n- Operational effects on private choice: entities may change how they store, transport or even whether they handle certain SSBAs in‑house to avoid regulatory cost or exposure (eg, increase use of licensed warehouses covered by reg 10). The Regulations thus influence business organisation and outsourcing decisions.\n\n**Bottom line (plain)**\n\n- These Regulations set the detailed, operational rules that registered SSBA handlers must follow to stay on the National Register, to report incidents and to protect sensitive information. The Secretary and (where specified) police receive notifications promptly. The practical effect is tighter, nationally standardised monitoring and reporting of security‑sensitive biological material, at the cost of measurable compliance and administrative work for handlers (see regs 7, 13–21, 24–25)."}},"importantCases":[],"_links":{"self":"/api/acts/national-health-security-regulations-2018","history":"/api/acts/national-health-security-regulations-2018/history","analysis":"/api/acts/national-health-security-regulations-2018/analysis","conflicts":"/api/acts/national-health-security-regulations-2018/conflicts","importantCases":"/api/acts/national-health-security-regulations-2018/important-cases","documents":"/api/acts/national-health-security-regulations-2018/documents"}}