121.17—Records.

(a) An individual or entity required to register under this part must maintain complete records relating to the activities covered by this part. Such records must include:
(1) An accurate, current inventory for each select agent (including viral genetic elements, recombinant nucleic acids, and recombinant organisms) held in long-term storage (placement in a system designed to ensure viability for future use, such as in a freezer or lyophilized materials), including:
(i) The name and characteristics (e.g., strain designation, GenBank Accession number, etc.);
(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) Where stored (e.g., building, room, and freezer);
(iv) When moved from storage and by whom and when returned to storage and by whom;
(v) The select agent used and purpose of use;
(vi) Records created under § 121.16 or 42 CFR 73.16 (Transfers);
(vii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the select agent, the quantity transferred, the date of transfer, the sender, and the recipient; and
(viii) Records created under § 121.19 or 42 CFR 73.19 (Notification of theft, loss, or release);
(2) An accurate, current inventory for each toxin held, including:
(i) The name and characteristics;
(ii) The quantity acquired from another individual or entity (e.g., containers, vials, tubes, etc.), date of acquisition, and the source;
(iii) The initial and current quantity amount (e.g., milligrams, milliliters, grams, etc.);
(iv) The toxin used and purpose of use, quantity, date(s) of the use and by whom;
(v) Where stored (e.g., building, room, and freezer);
(vi) When moved from storage and by whom and when returned to storage and by whom, including quantity amount;
(vii) Records created under § 121.16 or 42 CFR 73.16 (Transfers);
(viii) For intra-entity transfers (sender and the recipient are covered by the same certificate of registration), the toxin, the quantity transferred, the date of transfer, the sender, and the recipient;
(ix) Records created under § 121.19 or 42 CFR 73.19 (Notification of theft, loss, or release);
(x) If destroyed, the quantity of toxin destroyed, the date of such action, and by whom.
(3) A current list of all individuals that have been granted access approval by the Administrator or the HHS Secretary;
(4) Information about all entries into areas containing select agents or toxins, including the name of the individual, name of the escort (if applicable), and the date and time of entry;
(5) Accurate, current records created under § 121.9 or 42 CFR 73.9 (Responsible official), § 121.11 or 42 CFR 73.11 (Security), § 121.12 or 42 CFR 73.12 (Biosafety), § 121.14 or 42 CFR 73.14 (Incident response), and § 121.15 or 42 CFR 73.15 (Training); and
(6) A written explanation of any discrepancies.
(b) The individual or entity must implement a system to ensure that all records and databases created under this part are accurate, have controlled access, and that their authenticity may be verified.
(c) All records created under this part must be maintained for 3 years and promptly produced upon request.