Tighter security ahead for nuclear materials in health care

The Nuclear Regulatory Commission (NRC) was set to issue a final rule requiring physical protections for “byproduct materials”—highly radioactive elements that might be used to make a dirty bomb—as Physics Today went to press. Produced in nuclear reactors and accelerators, the materials are widely used in hospitals for radiotherapy and in irradiators for both research and treating blood for transfusions. High-activity isotopes for medical applications include cesium-137, cobalt-60, iridium-192, and strontium-90.

Cesium-137 in the form of cesium chloride is considered particularly attractive to terrorists because of its fine-powder consistency, penetrating gamma radiation, and widespread availability in lightly guarded settings such as hospitals, blood banks, and universities. Experts have warned that a radiological dispersion device—a dirty bomb—could render a large portion of a city uninhabitable for long periods and create widespread panic and economic havoc. Considerable contamination could be accomplished simply by dispersing CsCl from a tall building or airplane.

The new NRC rule would establish regulations for physical protection measures, fingerprinting, and background checks. The rule is designed to replace security orders that the NRC has issued since 9/11 to cover many types of radiological materials. Unlike rules, orders take immediate effect, are issued with little or no input from stakeholders, and apply only to the licensees to whom they are issued. A rule will apply uniformly to all current and future licensees of the materials.

Originally approved by NRC commissioners in March 2012, the rule makes numerous changes to the orders, such as requiring that individuals who are deemed “trustworthy and reliable” by the facility management complete certain security training and mandating that each licensee review its access programs at least once a year. The Office of Management and Budget, which reviews all new regulations, assented to the rule in January. It will take effect one year after its publication in the Federal Register, and the 37 states that have agreements to administer NRC regulations will have three years to implement it.

The NRC rule requires that licensees allow only trustworthy individuals to have access to the materials, verify each individual’s identity, install intrusion detection systems, and enhance security for portable and mobile devices. It also requires that licensees coordinate with local law enforcement to respond to actual or attempted theft, sabotage, or diversion of radioactive materials; promptly report incidents to appropriate government agencies; and closely monitor shipments.

A flexible approach

Some experts are concerned that the rule is not sufficiently prescriptive. For example, licensees will be allowed to have an intrusion detection system linked to an onsite or offsite monitoring facility, electronic alarms to alert facility personnel, or a video surveillance system or direct visual surveillance by individuals. The NRC does not approve a licensee’s security measures in advance, according to a December report by the Congressional Research Service. Rather, regulators inspect the facility once the measures are in place to determine whether they meet rule requirements.

Charles Ferguson, president of the Federation of American Scientists, notes that the flexibility is allowed because the variety of medical facilities makes a one-size-fits-all approach impractical. An expert on radiological sources, Ferguson described the rule as a “work in progress and a step in the right direction.” An ongoing dialog between the NRC and its licensees is necessary, he says. An opportunity for that dialog will be presented by the commission’s guidance to licensees on implementation of the rule. The guidance, he says, should be a “living document.”

The Government Accountability Office (GAO), in a September report, recommended that the NRC issue more specific directions on the use of cameras, alarms, and other physical security measures in medical settings. Officials at some of the 26 NRC-licensed medical facilities the GAO visited worried that hospital personnel may lack the experience to judge whether individuals should be allowed unescorted access to radiological sources. Performing background checks on foreign nationals, who are prevalent at many hospitals, is especially problematic, the officials told the GAO. Some hospital administrators told the GAO they wanted the NRC to help with background checks.

The GAO found significant security lapses at some of the facilities it visited. At one unidentified hospital, the blood bank, which contained a blood irradiator with about 1500 curies of ¹³⁷Cs, had the combination to the lock written on the door frame. At another hospital, two ¹³⁷Cs research irradiators containing 2000 and 6000 curies were housed in a building open to the public. A security camera in the hallway outside the irradiator room was pointed the wrong way, and one of the machines was on wheels. There were no cameras or other security systems inside the room, which was accessed by a swipe card.

The Congressional Research Service report said the “layered defense” approach of the NRC rule reduces the likelihood of a successful terrorist attack: “Vulnerabilities are inevitable: someone deemed [trustworthy and reliable] might not be, security systems could fail, or police might not respond in time. Nonetheless, the ability of one layer to offset weaknesses in others can be expected to improve security, especially as terrorists would not necessarily know where vulnerabilities are or how to exploit them.”

Help with upgrades

In parallel with the NRC’s regulatory process, the Department of Energy’s National Nuclear Security Administration (NNSA) has been funding, installing, and maintaining new security equipment at medical facilities and at other sites using high-risk radiological sources. An NNSA official who requested anonymity says that as of early February the agency has provided physical protection upgrades to more than 500 US civilian facilities that use or store such sources. The official did not provide a breakdown of the number of medical facilities involved in the voluntary program. But the GAO report stated that the NNSA has identified approximately 1500 US medical facilities with high-risk radiological sources as candidates for security upgrades. In total, those facilities contain approximately 28 million curies of radioactive material.

According to the GAO report, the NNSA doesn’t expect to complete the medical facility upgrades until 2025, at a total estimated cost of $608 million. The average cost so far for upgrades at each hospital has been $318 000. The NNSA official said that facilities contribute to the cost of installation “where possible. Otherwise, upgrades are supported by NNSA.” In all cases, the facility management must commit to operate and maintain the upgrades once the warranty period runs out, the official added. The NNSA estimates it will cost participating hospitals around $10 000 annually to do so. Some hospital administrators have declined to participate in the NNSA program and say that their security measures are adequate.

A major component of the NNSA program is the installation of in-device security kits on blood and research irradiators and radiosurgery devices called gamma knives. The kits will significantly increase the amount of time it would take intruders to remove the radiological material from hospital equipment and will give law enforcement additional time to apprehend the perpetrators.