High-risk radiological materials, which are often used to treat cancer, purify blood or conduct research, can be used to make a “dirty bomb.” The materials, although stored in sealed containers, are vulnerable to theft or misuse, in part because of their small size and portability.
“While we understand that some hospitals and medical facilities may not participate in the program due to cost concerns, the longer the security upgrades remain unimplemented, the greater the risk that potentially dangerous radiological materials from these facilities could be used as a terrorist weapon,” the GAO concluded.
The American Hospital Association said existing rules set by the Nuclear Regulatory Commission and Joint Commission require hospitals to secure radioactive materials. “Hospitals are committed to strengthening security and safeguarding their communities,” Roslyne Schulman, the AHA's director of policy, said in a statement.
As of March 2012, the National Nuclear Security Administration has spent $105 million to upgrade security at 321 high-risk hospitals and healthcare facilities, and the agency expects to complete all 1,503 security upgrades by 2025. Half of the 26 hospitals and healthcare facilities surveyed by the GAO had volunteered for and received the security upgrades.
Fourteen facilities have declined participation in the program, including one unnamed hospital with a blood irradiator that is located in an undisclosed major U.S. city.
Hospital officials told the GAO that they were concerned about “maintenance costs associated with the security equipment after the three- to five-year NNSA-funded warranty period expired.” Maintenance costs are estimated to be about $10,000 per facility per year after the warranty period ends.
A security officer at the unnamed hospital told the GAO that “the hospital is under serious budget pressure that makes it difficult to justify spending more money to sustain equipment for protecting their radiological sources.”
The resources required to keep the materials secure is a concern even for lower-risk facilities that are also regulated by the Nuclear Regulatory Commission but do not house the types of high-risk materials that would make them qualify for the upgrade program.
Gundersen Lutheran Health System, which has a 261-bed hospital in La Crosse, Wis., purchased three security cameras that are monitored 24 hours a day and installed card-swipe access locks on storage rooms housing radiological materials in 2008, according to Mary Ellen Jafari, Gundersen's radiation safety officer and a medical radiation physicist. “Cost is definitely an issue,” Jafari said.
The GAO report also questioned the adequacy of the NRC's risk-based approach to improving the security of radiological sources at healthcare facilities and recommended that the NRC strengthen its security requirements. The report cited specific examples of weak security, including a blood irradiator stored on a wheeled pallet down the hall from a loading dock. An irradiator at another facility had the combination to the locked door written on a door frame.
The GAO said the NRC's security requirements act more like a framework for how to secure radiological materials rather than setting out specific measures detailing how providers can secure equipment that contains radiological material. However, NRC officials cited the differences in providers' financial health, as well as the varying facility types, layouts and operations, as reasons why a “one-size-fits-all” approach to security requirements wouldn't work.
One small unnamed medical facility reported that implementing specific security requirements, including cameras and other equipment, could “jeopardize continued operations” due to installation and maintenance costs.
Jafari, who also consults with hospitals about how they secure radiological materials, said the current requirements are adequate. “Since 9/11, the state and the NRC are taking a much more rigorous approach,” she said.
If anything were to change, she said, the NRC should require that every facility conduct an annual audit of its security for high-risk radiological materials. At lower-risk facilities, an audit is conducted by NRC or state inspectors every three years.