NRC Requirements and Implementation by Licensees Do Not Ensure the Security of High-Risk Radiological Sources

At the 26 selected hospitals and medical facilities we visited, NRC’s  requirements did not consistently ensure the security of high-risk  radiological sources. One reason for this is that the requirements, which  are contained in NRC security controls (i.e., the two security orders and  implementation guidance) are broadly written and do not prescribe  specific measures that licensees must take to secure their equipment  containing high-risk radiological sources. Rather, the security controls and their requirements  provide a general framework for what constitutes adequate security  practices. At a hospital in a major U.S. city, we observed that the interior door to  the hospital blood bank, which had a cesium-137 blood irradiator of  approximately 1,500 curies, had the combination to the lock written  on the door frame. In the past, he said, the hospital had as  many as 800 people with unescorted access to sources. NNSA Completed Security Upgrades in More Than 300 Medical Facilities, but Some Hospitals Do Not Participate in the Voluntary Program

As of April 2012, NNSA had completed security upgrades at 321, or one- fifth, of the 1,503 U.S. hospital and medical facilities it had identified as  having high-risk radiological material but does not expect to complete all  such upgrades until 2025. According to NNSA officials, as of March 2012, the Domestic  Material Protection program had spent approximately $105 million to  provide security upgrades to radiological sources at the 321 facilities. Of the 26 hospitals and medical facilities that we visited in seven states  and the District of Columbia, 13 had received NNSA upgrades, and 3  were in the process of receiving upgrades. We observed a number of security upgrades  at these facilities, including remote monitoring systems, surveillance  cameras, enhanced security doors, iris scanners, motion detectors, and  tamper alarms. These 14 facilities contain over 41,000 curies  of high-risk radiological material. Specifically, we found the following:
According to police department officials in a major U.S. city, one  hospital with a blood irradiator of approximately 1,700 curies has  declined the NNSA upgrades, even though the police department  considers it to be a high-risk facility. As a result, 14 hospitals and medical facilities, with a  combined 41,000 curies of high-risk radiological material, have declined  to participate in the program, and several of these facilities are located in  or in close proximity to populated urban areas. For example, we were told that an irradiator stored on a  wheeled pallet located down the hall from a loading dock had not raised  inspectors’ concerns during the facility’s most recent NRC security  inspection. Because the security of radiological sources in hospitals and medical  facilities has national security implications, and many potentially  vulnerable medical facilities with high-risk sources have not received  security upgrades, we recommend that the Administrator of NNSA, in  consultation with the Chairman of NRC and Agreement State officials,  take the following action:  Increase outreach efforts to promote awareness of and participation in  NNSA’s security upgrade program. In addition, to help address the security vulnerabilities at U.S. hospitals  and medical facilities that contain high-risk radiological materials, we  recommend that the Chairman of the Nuclear Regulatory Commission  take the following three actions:
Strengthen NRC security requirements by providing hospitals and  medical facilities with specific measures they must take to develop  and sustain a more effective security program, including specific  direction on the use of cameras, alarms, and other relevant physical  security measures. NRC neither agreed nor disagreed with our other recommendations that it  (1) strengthen its security requirements by providing hospital and medical  facilities with specific measures they must take to develop and sustain a  more effective security program; (2) ensure that NRC and Agreement  State inspectors receive more comprehensive training to improve their  security awareness and ability to conduct related security inspections;  and (3) train facility officials who may be responsible for implementing  NRC security controls in how to adequately secure equipment and  conduct trustworthiness and reliability determinations. Consequently, we found that some of the  medical equipment in the facilities we visited was more vulnerable to  potential tampering or theft than that of other facilities, even though all the  facilities we visited had implemented NRC’s security controls and  undergone inspections by either NRC or Agreement State inspectors. For these reasons, we continue to believe our  recommendation that NRC strengthen its security requirements is  appropriate.
Why GAO Did This Study

In the hands of terrorists, radiological material, such as cesium-137, could be used to construct a "dirty bomb." Such material--encapsulated in steel or titanium and called a sealed source--is commonly found in equipment used by U.S. medical facilities to treat, among other things, cancer patients. NRC is responsible for regulating the commercial use of sealed sources and has relinquished its regulatory authority to 37 states, known as Agreement States. In 2008, NNSA established a program to provide security upgrades to U.S. hospitals and medical facilities that use radiological sources. GAO was asked to determine (1) the extent to which NRC's requirements ensure the security of radiological sources at U.S. medical facilities and (2) the status of NNSA's efforts to improve the security of sources at these facilities. GAO reviewed relevant laws, regulations, and guidance; interviewed federal agency and state officials; and visited 26 hospitals and medical facilities in 7 states and Washington, D.C.

What GAO Found

The Nuclear Regulatory Commission's (NRC) requirements do not consistently ensure the security of high-risk radiological sources at the 26 selected hospitals and medical facilities GAO visited. One reason for this is that the requirements are broadly written and do not prescribe specific measures that hospitals and medical facilities must take to secure medical equipment containing sealed sources, such as the use of cameras or alarms. Rather, the requirements provide a general framework for what constitutes adequate security practices, which is implemented in various ways at different hospitals. Some of the medical equipment in the facilities visited was more vulnerable to potential tampering or theft than that of other facilities because some hospitals developed better security controls than others. Some examples of poor security GAO observed included: an irradiator, used for medical research and containing almost 2,000 curies of cesium-137, was stored on a wheeled pallet down the hall from, and accessible to, a loading dock at one facility; at a second facility, the combination to a locked door, which housed an irradiator containing 1,500 curies of cesium- 137, was clearly written on the door frame; and at a third facility, an official told GAO that the number of people with unescorted access to the facility's radiological sources was estimated to be at least 500. In addition, some NRC and Agreement State inspectors said the training NRC requires is not sufficient.
As of March 2012, the National Nuclear Security Administration (NNSA) had spent $105 million to complete security upgrades at 321 of the 1,503 U.S. hospitals and medical facilities it identified as having high-risk radiological sources. Of the 26 hospitals and medical facilities that GAO visited, 13 had volunteered for the NNSA security upgrades and had received security upgrades, such as remote monitoring systems, surveillance cameras, enhanced security doors, iris scanners, motion detectors, and tamper alarms; three others were in the process of receiving upgrades. However, NNSA does not anticipate completing all such security upgrades until 2025, leaving a number of facilities potentially vulnerable. In addition, the program's impact is limited because, among other things, it is voluntary, and facilities can decline to participate. To date, 14 facilities, including 4 in large urban areas, have declined to participate in the program. Combined, those 14 facilities have medical equipment containing over 41,000 curies of high-risk radiological material. According to police department officials in a major city, one hospital with a blood irradiator of approximately 1,700 curies has declined the NNSA upgrades due in part to cost concerns, even though the police department considers it to be a high-risk facility.

What GAO Recommends

GAO recommends, among other things, that NRC strengthen its security requirements by providing medical facilities with specific measures they must take to develop and sustain a more effective security program. NRC neither agreed nor disagreed with this recommendation and stated that its existing security requirements are adequate. GAO continues to believe that implementing its recommendation would contribute to increased security at U.S. hospitals and medical facilities.