In an effort to provide you with the new language I have presented this material, cut from EPA’s early release document which was several hundred pages. Here is what is actually changing in the rule:
§ 68.3 Definitions.
Active measures mean risk management measures or engineering controls that rely on mechanical, or other energy input to detect and respond to process deviations. Examples of active measures include alarms, safety instrumented systems, and detection hardware (such as hydrocarbon sensors).
CBI means confidential business information.
Inherently safer technology or design means risk management measures that minimize the use of regulated substances, substitute less hazardous substances, moderate the use of regulated substances, or simplify covered processes in order to make accidental releases less likely, or the impacts of such releases less severe.
LEPC means local emergency planning committee as established under 42 U.S.C. 11001(c).
Passive measures mean risk management measures that use design features that reduce either the frequency or consequence of the hazard without human, mechanical, or other energy input. Examples of passive measures include pressure vessel designs, dikes, berms, and blast walls.
Practicability means the capability of being successfully accomplished within a reasonable time, accounting for economic, environmental, legal, social, and technological factors. Environmental factors would include consideration of potential transferred risks for new risk reduction measures. Procedural measures mean risk management measures such as policies, operating procedures, training, administrative controls, and emergency response actions to prevent or minimize incidents.
Root cause means a fundamental, underlying, system-related reason why an incident occurred.
Third party audit means a compliance audit conducted pursuant to the requirements of § 68.59 and/or § 68.80, performed or led by an entity (individual or firm) meeting the competency and independence described in § 68.59(c) or § 68.80(c).
3. Amend § 68.10 by:
a. Revising paragraph (a);
b. Redesignating paragraphs (b) through (f) as paragraphs (f) through (j);
c. Adding new paragraphs (b) through (e); and
d. Revising the newly designated paragraph (f)(2).
The revisions and additions read as follow:
§ 68.10 Applicability.
(a) Except as provided in paragraphs (b) through (e) of this section, an owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under § 68.115, shall comply with the requirements of this part no later than the latest of the following dates:
(1) June 21, 1999;
(2) Three years after the date on which a regulated substance is first listed under § 68.130;
(3) The date on which a regulated substance is first present above a threshold quantity in a process; or
(4) For any revisions to this part, the effective date of the final rule.
(b) By [INSERT DATE 60 DAYS AND 1 YEAR AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER] the owner or operator of a stationary source shall comply with the emergency response coordination activities in § 68.93.
(c) Within three years of when the owner or operator determines that the stationary source is subject to the emergency response program requirements of § 68.95, pursuant to § 68.90(a), the owner or operator must develop and implement an emergency response program in accordance with § 68.95.
(d) By [INSERT DATE 60 DAYS AND 4 YEARS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER], the owner or operator shall comply with the following provisions promulgated on [INSERT DATE OF PUBLICATION IN FEDERAL REGISTER]:
(1) Third-party audit provisions in §§ 68.58(f), 68.58(g), 68.58(h), 68.59, 68.79(f), 68.79(g), 68.79(h), and 68.80;
(2) Incident investigation root cause analysis provisions in §§ 68.60(d)(7) and 68.81(d)(7);
(3) Safer technology and alternatives analysis provisions in § 68.67(c)(8);
(4) Emergency response exercise provisions of § 68.96, and;
(5) Availability of information provisions in § 68.210(b) through (e).
(e) By [INSERT DATE 60 DAYS AND 5 YEARS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER], the owner or operator shall comply with the risk management plan provisions of subpart G of this Part promulgated on [INSERT DATE OF PUBLICATION IN
FEDERAL REGISTER].
(f) * * *
(2) The distance to a toxic or flammable endpoint for a worst-case release assessment conducted under subpart B and § 68.25 is less than the distance to any public receptor, as defined in § 68.3; and
* * * * *
4. Amend § 68.12 by:
a. Revising paragraphs (c)(4) and (5), and adding paragraph (c)(6); and
b. Revising paragraphs (d)(4) and (5), and adding paragraph (d)(6).
The revisions and additions read as follows:
§ 68.12 General requirements.
* * * * *
(c)
* * *
(4) Coordinate response actions with local emergency planning and response agencies as provided in § 68.93;
(5) Develop and implement an emergency response program, and conduct exercises, as provided in §§ 68.90 to 68.96; and
(6) Submit as part of the RMP the data on prevention program elements for Program 2 processes as provided in § 68.170.
(d)
* * *
(4) Coordinate response actions with local emergency planning and response agencies as provided in § 68.93;
(5) Develop and implement an emergency response program, and conduct exercises, as provided in §§ 68.90 to 68.96 of this part; and
(6) Submit as part of the RMP the data on prevention program elements for Program 3 processes as provided in § 68.175.
5. Amend § 68.48 by revising paragraph (a)(1) to read as follows:
§ 68.48 Safety information.
(a) * * *
(1) Safety Data Sheets (SDS) that meet the requirements of 29 CFR 1910.1200(g);
* * * * *
6. Amend § 68.50 by revising paragraph (a)(2) to read as follows:
§ 68.50 Hazard review.
(a) * * *
(2) Opportunities for equipment malfunctions or human errors that could cause an accidental release, including findings from incident investigations;
* * * * *
7. Amend § 68.54 by revising paragraphs (a), (b), and (d); and Adding a new paragraph (e) to read as follows:
§ 68.54 Training.
(a) The owner or operator shall ensure that each employee presently involved in operating a process, and each employee newly assigned to a covered process have been trained or tested competent in the operating procedures provided in § 68.52 that pertain to their duties. For those employees already operating a process on June 21, 1999, the owner or operator may certify in writing that the employee has the required knowledge, skills, and abilities to safely carry out the duties and responsibilities as provided in the operating procedures.
(b) Refresher training. Refresher training shall be provided at least every three years, and more often if necessary, to each employee involved in operating a process to ensure that the employee understands and adheres to the current operating procedures of the process. The owner or operator, in consultation with the employees operating the process, shall determine the appropriate frequency of refresher training.
* * * * *
(d) The owner or operator shall ensure that employees involved in operating a process are trained in any updated or new procedures prior to startup of a process after a major change.
(e) For the purposes of this section, the term employee also includes supervisors responsible for directing process operations.
8. Amend § 68.58 by revising paragraph (a) and adding paragraphs (f) through (h) to read as follows:
§ 68.58 Compliance audits.
(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart for each covered process, at least every three years to verify that the procedures and practices developed under the rule are adequate and are being followed. When required as set forth in paragraph (f) of this section, the compliance audit shall be a third-party audit.
* * * * *
(f) Third-party audit applicability. The next required compliance audit shall be a third-party audit when one of the following conditions apply:
(1) An accidental release meeting the criteria in § 68.42(a) from a covered process at a stationary source has occurred; or
(2) An implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.59(c).
(g) Implementing agency notification and appeals.
(1) If an implementing agency makes a preliminary determination that a third-party audit is necessary pursuant to paragraph (f)(2) of this section, the implementing agency will provide written notice to the owner or operator that describes the basis for this determination.
(2) Within 30 days of receipt of such written notice, the owner or operator may provide information and data to, and may consult with, the implementing agency on the determination. Thereafter, the implementing agency will provide a final determination to the owner or operator.
(3) If the final determination requires a third-party audit, the owner or operator shall comply with the requirements of § 68.59, pursuant to the schedule in paragraph (h) of this section.
(4) Appeals. The owner or operator may appeal a final determination made by an implementing agency under paragraph (g)(2) of this section within 30 days of receipt of the final determination. The appeal shall be made to the EPA Regional Administrator, or for determinations made by other implementing agencies, the administrator or director of such implementing agency. The appeal shall contain a clear and concise statement of the issues, facts in the case, and any relevant additional information. In reviewing the appeal, the implementing agency may request additional information from the owner or operator. The implementing agency will provide a written, final decision on the appeal to the owner or operator.
(h) Schedule for conducting a third-party audit. The audit and audit report shall be completed as follows, unless a different timeframe is specified by the implementing agency:
(1) For third-party audits required pursuant to paragraph (f)(1) of this section, within 12 months of the release; or
(2) For third-party audits required pursuant to paragraph (f)(2) of this section, within 12 months of the date of the final determination pursuant to paragraph (g)(3) of this section. However, if the final determination is appealed pursuant to paragraph (g)(4) of this section, within 12 months of the date of the final decision on the appeal.
9. Section 68.59 is added to subpart C to read as follows:
§ 68.59 Third-party audits.
(a) Applicability. The owner or operator shall engage a third-party to conduct an audit that evaluates compliance with the provisions of this subpart in accordance with the requirements of this section when either criterion of § 68.58(f) is met.
(b) Third-party auditors and auditing teams. The owner or operator shall either:
(1) Engage a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section; or
(2) Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section. The team may include:
(i) Other employees of the third-party auditor firm meeting the independence criteria of paragraph (c)(2) of this section; and
(ii) Other personnel not employed by the third-party auditor firm, including facility personnel.
(c) Third-party auditor qualifications. The owner or operator shall determine and document that the third-party auditor(s) meet the following competency and independence requirements:
(1) Competency requirements. The third-party auditor(s) shall be:
(i) Knowledgeable with the requirements of this part;
(ii) Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and
(iii) Trained and/or certified in proper auditing techniques.
(2) Independence requirements. The third-party auditor(s) shall:
(i) Act impartially when performing all activities under this section;
(ii) Receive no financial benefit from the outcome of the audit, apart from payment for auditing services. For purposes of this paragraph, retired employees who otherwise satisfy the third-party auditor independence criteria in this section may qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans;
(iii) Not have conducted past research, development, design, construction services, or consulting for the owner or operator within the last two years. For purposes of this requirement, consulting does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80. An audit firm with personnel who, before working for the auditor, conducted research, development, design, construction, or consulting services for the owner or operator within the last two years as an employee or contractor may meet the requirements of this subsection by ensuring such personnel do not participate in the audit, or manage or advise the audit team concerning the audit;
(iv) Not provide other business or consulting services to the owner or operator, including advice or assistance to implement the findings or recommendations in an audit report, for a period of at least two years following submission of the final audit report;
(v) Ensure that all third-party personnel involved in the audit sign and date a conflict of interest statement documenting that they meet the independence criteria of this paragraph; and
(vi) Ensure that all third-party personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least two years following submission of the final audit report. For purposes of this requirement, employment does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80.
(3) The auditor shall have written policies and procedures to ensure that all personnel comply with the competency and independence requirements of this section.
(d) Third-party auditor responsibilities. The owner or operator shall ensure that the third-party auditor:
(1) Manages the audit and participates in audit initiation, design, implementation, and reporting;
(2) Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;
(3) Prepares the audit report and where there is a team, documents the full audit team’s views in the final audit report;
(4) Certifies the final audit report and its contents as meeting the requirements of this section; and
(5) Provides a copy of the audit report to the owner or operator.
(e) Audit report. The audit report shall:
(1) Identify all persons participating on the audit team, including names, titles, employers and/or affiliations, and summaries of qualifications. For third-party auditors, include information demonstrating that the competency requirements in paragraph (c)(1) of this section are met;
(2) Describe or incorporate by reference the policies and procedures required under paragraph (c)(3) of this section;
(3) Document the auditor’s evaluation, for each covered process, of the owner or operator’s compliance with the provisions of this subpart to determine whether the procedures and practices developed by the owner or operator under this rule are adequate and being followed;
(4) Document the findings of the audit, including any identified compliance or performance deficiencies;
(5) Summarize any significant revisions (if any) between draft and final versions of the report; and
(6) Include the following certification, signed and dated by the third-party auditor or third-party audit team member leading the audit:
“I certify that this RMP compliance audit report was prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information upon which the audit is based. I further certify that the audit was conducted and this report was prepared pursuant to the requirements of subpart C of 40 CFR part 68 and all other applicable auditing, competency, independence, impartiality, and conflict of interest standards and protocols. Based on my personal knowledge and experience, and inquiry of personnel involved in the audit, the information submitted herein is true, accurate, and complete.”
(f) Third-party audit findings.
(1) Findings response report. As soon as possible, but no later than 90 days after receiving the final audit report, the owner or operator shall determine an appropriate response to each of the findings in the audit report, and develop a findings response report that includes:
(i) A copy of the final audit report;
(ii) An appropriate response to each of the audit report findings;
(iii) A schedule for promptly addressing deficiencies; and
(iv) A certification, signed and dated by a senior corporate officer, or an official in an equivalent position, of the owner or operator of the stationary source, stating:
“I certify under penalty of law that I have engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.59 and that the attached RMP compliance audit report was received, reviewed, and responded to under my direction or supervision by qualified personnel. I further certify that appropriate responses to the findings have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subpart C of 40 CFR part 68, as documented herein. Based on my personal knowledge and experience, or inquiry of personnel involved in evaluating the report findings and determining appropriate responses to the findings, the information submitted herein is true, accurate, and complete. I am aware that there are significant penalties for making false material statements, representations, or certifications, including the possibility of fines and imprisonment for knowing violations.”
(2) Schedule implementation. The owner or operator shall implement the schedule to address deficiencies identified in the audit findings response report in paragraph (f)(1)(iii) of this section and document the action taken to address each deficiency, along with the date completed.
(3) Submission to Board of Directors. The owner or operator shall immediately provide a copy of each document required under paragraphs (f)(1) and (f)(2) of this section, when completed, to the owner or operator’s audit committee of the Board of Directors, or other comparable committee or individual, if applicable.
(g) Recordkeeping. The owner or operator shall retain at the stationary source, the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records. This requirement does not apply to any document that is more than five years old.
10. Amend § 68.60 by:
a. Revising paragraph (a);
b. Redesignating paragraphs (c) through (f) as paragraphs (d) through (g);
c. Adding a new paragraph (c); and
d. Revising the newly designated paragraphs (d) and (g).
The revisions and additions read as follows:
§ 68.60 Incident investigation.
(a) The owner or operator shall investigate each incident that:
(1) Resulted in a catastrophic release (including when the affected process is decommissioned or destroyed following, or as the result of, an incident); or
(2) Could reasonably have resulted in a catastrophic release (i.e., was a near miss).
* * * * *
(c) An incident investigation team shall be established and consist of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident.
(d) A report shall be prepared at the conclusion of the investigation. The report shall be completed within 12 months of the incident, unless the implementing agency approves, in writing, an extension of time. The report shall include:
(1) Date, time, and location of incident;
(2) Date investigation began;
(3) A description of the incident, in chronological order, providing all relevant facts;
(4) The name and amount of the regulated substance involved in the release (e.g., fire, explosion, toxic gas loss of containment) or near miss and the duration of the event;
(5) The consequences, if any, of the incident including, but not limited to: injuries, fatalities, the number of people evacuated, the number of people sheltered in place, and the impact on the environment;
(6) Emergency response actions taken;
(7) The factors that contributed to the incident including the initiating event, direct and indirect contributing factors, and root causes. Root causes shall be determined by conducting an analysis for each incident using a recognized method; and
(8) Any recommendations resulting from the investigation and a schedule for addressing them.
* * * * *
(g) Incident investigation reports shall be retained for five years.
11. Amend § 68.65 by revising the first sentence of paragraph (a) and the note to paragraph (b) to read as follows:
§ 68.65 Process safety information.
(a) The owner or operator shall complete a compilation of written process safety information before conducting any process hazard analysis required by the rule, and shall keep process safety information up-to-date. * * *
(b) * * *
Note to paragraph (b): Safety Data Sheets (SDS) meeting the requirements of 29 CFR 1910.1200(g) may be used to comply with this requirement to the extent they contain the information required by this subparagraph.
12. Amend § 68.67 by:
a. Revising paragraph (c)(2);
b. Revising paragraph (c)(6) by removing the word “and;”
c. Revising paragraph (c)(7) by removing the period at the end of the paragraph and adding “; and” in its place; and
d. Adding paragraph (c)(8).
The revisions and additions read as follows:
§ 68.67 Process hazard analysis.
* * * * *
(c) * * *
(2) The findings from all incident investigations required under § 68.81, as well as any other potential failure scenarios;
* * * * *
(8) For processes in NAICS 322, 324, and 325, safer technology and alternative risk management measures applicable to eliminating or reducing risk from process hazards.
(i) The owner or operator shall consider, in the following order of preference inherently safer technology or design, passive measures, active measures, and procedural measures. A combination of risk management measures may be used to achieve the desired risk reduction.
(ii) The owner or operator shall determine the practicability of the inherently safer technologies and designs considered.
* * * * *
13. Amend § 68.71 by adding paragraph (d) to read as follows:
§ 68.71 Training.
* * * * *
(d) For the purposes of this section, the term employee also includes supervisors with process operational responsibilities.
14. Amend § 68.79 by revising paragraph (a) and adding paragraphs (f) through (h) to read as follows:
§ 68.79 Compliance audits.
(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart for each covered process, at least every three years to verify that the procedures and practices developed under the rule are adequate and are being followed. When required as set forth in paragraph (f) of this section, the compliance audit shall be a third-party audit.
* * * * *
(f) Third-party audit applicability. The next required compliance audit shall be a third-party audit when one of the following conditions apply:
(1) An accidental release meeting the criteria in § 68.42(a) from a covered process at a stationary source has occurred; or
(2) An implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.80(c).
(g) Implementing agency notification and appeals.
(1) If an implementing agency makes a preliminary determination that a third-party audit is necessary pursuant to paragraph (f)(2) of this section, the implementing agency will provide written notice to the owner or operator that describes the basis for this determination.
(2) Within 30 days of receipt of such written notice, the owner or operator may provide information and data to, and may consult with, the implementing agency on the determination. Thereafter, the implementing agency will provide a final determination to the owner or operator.
(3) If the final determination requires a third-party audit, the owner or operator shall comply with the requirements of § 68.80, pursuant to the schedule in paragraph (h) of this section.
(4) Appeals. The owner or operator may appeal a final determination made by an implementing agency under paragraph (g)(2) of this section within 30 days of receipt of the final determination. The appeal shall be made to the EPA Regional Administrator, or for determinations made by other implementing agencies, the administrator or director of such implementing agency. The appeal shall contain a clear and concise statement of the issues, facts in the case, and any relevant additional information. In reviewing the appeal, the implementing agency may request additional information from the owner or operator. The implementing agency will provide a written, final decision on the appeal to the owner or operator.
(h) Schedule for conducting a third-party audit. The audit and audit report shall be completed as follows, unless a different timeframe is specified by the implementing agency:
(1) For third-party audits required pursuant to paragraph (f)(1) of this section, within 12 months of the release; or
(2) For third-party audits required pursuant to paragraph (f)(2) of this section, within 12 months of the date of the final determination pursuant to paragraph (g)(
(3) of this section. However, if the final determination is appealed pursuant to paragraph (g)(4) of this section, within 12 months of the date of the final decision on the appeal.
15. Section 68.80 is added to subpart D to read as follows:
§ 68.80 Third-party audits.
(a) Applicability. The owner or operator shall engage a third-party to conduct an audit that evaluates compliance with the provisions of this subpart in accordance with the requirements of this section when either criterion of § 68.79(f) is met.
(b) Third-party auditors and auditing teams. The owner or operator shall either:
(1) Engage a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section; or
(2) Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section. The team may include:
(i) Other employees of the third-party auditor firm meeting the independence criteria of paragraph (c)(2) of this section; and
(ii) Other personnel not employed by the third-party auditor firm, including facility personnel.
(c) Third-party auditor qualifications. The owner or operator shall determine and document that the third-party auditor(s) meet the following competency and independence requirements:
(1) Competency requirements. The third-party auditor(s) shall be:
(i) Knowledgeable with the requirements of this part;
(ii) Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and
(iii) Trained or certified in proper auditing techniques.
(2) Independence requirements. The third-party auditor(s) shall:
(i) Act impartially when performing all activities under this section;
(ii) Receive no financial benefit from the outcome of the audit, apart from payment for auditing services. For purposes of this paragraph, retired employees who otherwise satisfy the third-party auditor independence criteria in this section may qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans;
(iii) Not have conducted past research, development, design, construction services, or consulting for the owner or operator within the last two years. For purposes of this requirement, consulting does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80. An audit firm with personnel who, before working for the auditor, conducted research, development, design, construction, or consulting services for the owner or operator within the last two years as an employee or contractor may meet the requirements of this subsection by ensuring such personnel do not participate in the audit, or manage or advise the audit team concerning the audit;
(iv) Not provide other business or consulting services to the owner or operator, including advice or assistance to implement the findings or recommendations in an audit report, for a period of at least two years following submission of the final audit report;
(v) Ensure that all third-party personnel involved in the audit sign and date a conflict of interest statement documenting that they meet the independence criteria of this paragraph; and
(vi) Ensure that all third-party personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least two years following submission of the final audit report. For purposes of this requirement, employment does not include performing or participating in third-party audits pursuant to § 68.59 or § 68.80.
(3) The auditor shall have written policies and procedures to ensure that all personnel comply with the competency and independence requirements of this section.
(d) Third-party auditor responsibilities. The owner or operator shall ensure that the third-party auditor:
(1) Manages the audit and participates in audit initiation, design, implementation, and reporting;
(2) Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;
(3) Prepares the audit report and where there is a team, documents the full audit team’s views in the final audit report;
(4) Certifies the final audit report and its contents as meeting the requirements of this section; and
(5) Provides a copy of the audit report to the owner or operator.
(e) Audit report. The audit report shall:
(1) Identify all persons participating on the audit team, including names, titles, employers and/or affiliations, and summaries of qualifications. For third-party auditors, include information demonstrating that the competency requirements in paragraph (c)(1) of this section are met;
(2) Describe or incorporate by reference the policies and procedures required under paragraph (c)(3) of this section;
(3) Document the auditor’s evaluation, for each covered process, of the owner or operator’s compliance with the provisions of this subpart to determine whether the procedures and practices developed by the owner or operator under this rule are adequate and being followed;
(4) Document the findings of the audit, including any identified compliance or performance deficiencies;
(5) Summarize any significant revisions (if any) between draft and final versions of the report; and
(6) Include the following certification, signed and dated by the third-party auditor or third-party audit team member leading the audit:
“I certify that this RMP compliance audit report was prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information upon which the audit is based. I further certify that the audit was conducted and this report was prepared pursuant to the requirements of subpart D of 40 CFR part 68 and all other applicable auditing, competency, independence, impartiality, and conflict of interest standards and protocols. Based on my personal knowledge and experience, and inquiry of personnel involved in the audit, the information submitted herein is true, accurate, and complete.”
(f) Third-party audit findings.
(1) Findings response report. As soon as possible, but no later than 90 days after receiving the final audit report, the owner or operator shall determine an appropriate response to each of the findings in the audit report, and develop a findings response report that includes:
(i) A copy of the final audit report;
(ii) An appropriate response to each of the audit report findings;
(iii) A schedule for promptly addressing deficiencies; and
(iv) A certification, signed and dated by a senior corporate officer, or an official in an equivalent position, of the owner or operator of the stationary source, stating:
“I certify under penalty of law that I have engaged a third-party to perform or lead an audit team to conduct a third-party audit in accordance with the requirements of 40 CFR 68.80 and that the attached RMP compliance audit report was received, reviewed, and responded to under my direction or supervision by qualified personnel. I further certify that appropriate responses to the findings have been identified and deficiencies were corrected, or are being corrected, consistent with the requirements of subpart D of 40 CFR part 68, as documented herein. Based on my personal knowledge and experience, or inquiry of personnel involved in evaluating the report findings and determining appropriate responses to the findings, the information submitted herein is true, accurate, and complete. I am aware that there are significant penalties for making false material statements, representations, or certifications, including the possibility of fines and imprisonment for knowing violations.”
(2) Schedule implementation. The owner or operator shall implement the schedule to address deficiencies identified in the audit findings response report in paragraph (f)(1)(iii) of this section and document the action taken to address each deficiency, along with the date completed.
(3) Submission to Board of Directors. The owner or operator shall immediately provide a copy of each document required under paragraphs (f)(1) and (f)(2) of this section, when completed, to the owner or operator’s audit committee of the Board of Directors, or other comparable committee or individual, if applicable.
(g) Recordkeeping. The owner or operator shall retain at the stationary source the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records.
16. Amend § 68.81 by revising paragraphs (a), (d) introductory text, (d)(1), (d)(3) through (5), and adding paragraphs (d)(6) through (8) to read as follows:
§ 68.81 Incident investigation.
(a) The owner or operator shall investigate each incident that:
(1) Resulted in a catastrophic release (including when the affected process is decommissioned or destroyed following, or as the result of, an incident); or
(2) Could reasonably have resulted in a catastrophic release (i.e., was a near miss).
* * * * *
(d) A report shall be prepared at the conclusion of the investigation. The report shall be completed within 12 months of the incident, unless the implementing agency approves, in writing, an extension of time. The report shall include:
(1) Date, time, and location of incident;
* * * * *
(3) A description of the incident, in chronological order, providing all relevant facts;
(4) The name and amount of the regulated substance involved in the release (e.g., fire, explosion, toxic gas loss of containment) or near miss and the duration of the event;
(5) The consequences, if any, of the incident including, but not limited to: injuries, fatalities, the number of people evacuated, the number of people sheltered in place, and the impact on the environment;
(6) Emergency response actions taken;
(7) The factors that contributed to the incident including the initiating event, direct and indirect contributing factors, and root causes. Root causes shall be determined by conducting an analysis for each incident using a recognized method; and
(8) Any recommendations resulting from the investigation and a schedule for addressing them.
* * * * *
17. Revise § 68.90 to read as follows:
§ 68.90 Applicability.
(a) Responding stationary source. Except as provided in paragraph (b) of this section, the owner or operator of a stationary source with Program 2 and Program 3 processes shall comply with the requirements of §§ 68.93, 68.95, and 68.96.
(b) Non-responding stationary source. The owner or operator of a stationary source whose employees will not respond to accidental releases of regulated substances need not comply with § 68.95 of this part provided that:
(1) For stationary sources with any regulated toxic substance held in a process above the threshold quantity, the stationary source is included in the community emergency response plan developed under 42 U.S.C. 11003;
(2) For stationary sources with only regulated flammable substances held in a process above the threshold quantity, the owner or operator has coordinated response actions with the local fire department;
(3) Appropriate mechanisms are in place to notify emergency responders when there is a need for a response;
(4) The owner or operator performs the annual emergency response coordination activities required under § 68.93; and
(5) The owner or operator performs the annual notification exercises required under § 68.96(a).
18. Section 68.93 is added to subpart E to read as follows:
§ 68.93 Emergency response coordination activities.
The owner or operator of a stationary source shall coordinate response needs with local emergency planning and response organizations to determine how the stationary source is addressed in the community emergency response plan and to ensure that local response organizations are aware of the regulated substances at the stationary source, their quantities, the risks presented by covered processes, and the resources and capabilities at the stationary source to respond to an accidental release of a regulated substance.
(a) Coordination shall occur at least annually, and more frequently if necessary, to address changes: at the stationary source; in the stationary source’s emergency response and/or emergency action plan; and/or in the community emergency response plan.
(b) Coordination shall include providing to the local emergency planning and response organizations: the stationary source’s emergency response plan if one exists; emergency action plan; updated emergency contact information; and any other information that local emergency planning and response organizations identify as relevant to local emergency response planning. For responding stationary sources, coordination shall also include consulting with local emergency response officials to establish appropriate schedules and plans for field and tabletop exercises required under § 68.96(b). The
owner or operator shall request an opportunity to meet with the local emergency planning committee (or equivalent) and/or local fire department as appropriate to review and discuss these materials.
(c) The owner or operator shall document coordination with local authorities, including: the names of individuals involved and their contact information (phone number, email address, and organizational affiliations); dates of coordination activities; and nature of coordination activities.
19. Amend § 68.95 by:
a. Revising paragraph (a)(1)(i);
b. Adding a sentence to the end of paragraph (a)(4); and
c. Revising paragraph (c).
The revisions and addition read as follows:
68.95 Emergency response program.
(a) * * *
(1) * * *
(i) Procedures for informing the public and the appropriate Federal, state, and local emergency response agencies about accidental releases;
* * * * *
(4) * * * The owner or operator shall review and update the plan as appropriate based on changes at the stationary source or new information obtained from coordination activities, emergency response exercises, incident investigations, or other available information, and ensure that employees are informed of the changes.
* * * * *
(c) The emergency response plan developed under paragraph (a)(1) of this section shall be coordinated with the community emergency response plan developed under 42 U.S.C. 11003. Upon request of the LEPC or emergency response officials, the owner or operator shall promptly provide to the local emergency response officials information necessary for developing and implementing the community emergency response plan.
20. Section 68.96 is added to subpart E to read as follows:
§ 68.96 Emergency response exercises.
(a) Notification exercises. At least once each calendar year, the owner or operator of a stationary source with any Program 2 or Program 3 process shall conduct an exercise of the stationary source’s emergency response notification mechanisms required under § 68.90(a)(2) or § 68.95(a)(1)(i), as appropriate. Owners or operators of responding stationary sources may perform the notification exercise as part of the tabletop and field exercises required in § 68.96(b). The owner/operator shall maintain a written record of each notification exercise conducted over the last five years.
(b) Emergency response exercise program. The owner or operator of a stationary source subject to the requirements of § 68.95 shall develop and implement an exercise program for its emergency response program, including the plan required under § 68.95(a)(1). Exercises shall involve facility emergency response personnel and, as appropriate, emergency response contractors. When planning emergency response field and tabletop exercises, the owner or operator shall coordinate with local public emergency response officials and invite them to participate in the exercise. The emergency response
exercise program shall include:
(1) Emergency response field exercises. The owner or operator shall conduct field exercises involving the simulated accidental release of a regulated substance (i.e., toxic substance release or release of a regulated flammable substance involving a fire and/or explosion).
(i) Frequency. As part of coordination with local emergency response officials required by §68.93, the owner or operator shall consult with these officials to establish an appropriate frequency for field exercises, but at a minimum, shall conduct a field exercise at least once every ten years.
(ii) Scope. Field exercises shall include: tests of procedures to notify the public and the appropriate Federal, state, and local emergency response agencies about an accidental release; tests of procedures and measures for emergency response actions including evacuations and medical treatment;
tests of communications systems; mobilization of facility emergency response personnel, including contractors, as appropriate; coordination with local emergency responders; emergency response equipment deployment; and any other action identified in the emergency response program, as appropriate.
(2) Tabletop exercises. The owner or operator shall conduct a tabletop exercise involving the simulated accidental release of a regulated substance.
(i) Frequency. As part of coordination with local emergency response officials required by §68.93, the owner or operator shall consult with these officials to establish an appropriate frequency for tabletop exercises, but at a minimum, shall conduct a field exercise at least once every three years.
(ii) Scope. The exercise shall include discussions of: procedures to notify the public and the appropriate Federal, state, and local emergency response agencies; procedures and measures for emergency response including evacuations and medical treatment; identification of facility emergency response personnel and/or contractors and their responsibilities; coordination with local emergency responders; procedures for emergency response equipment deployment; and any other action identified in the emergency response plan, as appropriate.
(3) Documentation. The owner/operator shall prepare an evaluation report within 90 days of each exercise. The report shall include: a description of the exercise scenario; names and organizations of each participant; an evaluation of the exercise results including lessons learned; recommendations for improvement or revisions to the emergency response exercise program and emergency response program, and a schedule to promptly address and resolve recommendations.
(c) Alternative means of meeting exercise requirements. The owner or operator may satisfy the requirement to conduct notification, field and/or tabletop exercises through:
(1) Exercises conducted to meet other Federal, state or local exercise requirements, provided the exercise meets the requirements of paragraphs (a) and/or (b) of this section, as appropriate.
(2) Response to an accidental release, provided the response includes the actions indicated in paragraphs (a) and/or (b) of this section, as appropriate. When used to meet field and/or tabletop exercise requirements, the owner or operator shall prepare an after-action report comparable to the exercise evaluation report required in paragraph (b)(3) of this section, within 90 days of the incident.
21. Amend § 68.130 by:
a. In Table 1, “List of Regulated Toxic Substances and Threshold Quantities for Accidental Release Prevention”, under second column entitled “CAS No.”, removing the number “107-18-61” adding “107-18-6” in its place; and
b. Revising Table 4, “List of Regulated Flammable Substances and Threshold Quantities for Accidental Release Prevention”.
22. Amend § 68.160 by adding paragraphs (b)(21) and (22) to read as follows:
§ 68.160 Registration.
* * * * *
(b) * * *
(21) Method of communication and location of the notification that chemical hazard information is available to the public, pursuant to § 68.210(c); and
(22) Whether a public meeting has been held following an RMP reportable accident, pursuant to §68.210(e).
23. Amend § 68.170 by revising paragraphs (i) and (j) to read as follows:
§ 68.170 Prevention program/Program 2.
* * * * *
(i) The date of the most recent compliance audit, the expected date of completion of any changes resulting from the compliance audit, and identify whether the most recent compliance audit was a thirdparty audit, pursuant to §§ 68.58 and 68.59.
(j) The completion date of the most recent incident investigation and the expected date of completion of any changes resulting from the investigation.
* * * * *
24. Amend § 68.175 by:
a. Revising introductory paragraph (e), and paragraphs (e)(1), (e)(5), and (e)(6);
b. Adding paragraph (e)(7); and
c. Revising paragraphs (k) and (l).
The revisions and addition read as follows:
§ 68.175 Prevention program/Program 3.
* * * * *
(e) The most recent process hazard analysis (PHA) or PHA update and revalidation information, pursuant to § 68.67, including:
(1) The date of completion of the most recent PHA or update and the technique used;
* * * * *
(5) Monitoring and detection systems in use;
(6) Changes since the last PHA; and
(7) Inherently safer technology or design measures implemented since the last PHA, if any, and the technology category (substitution, minimization, simplification and/or moderation).
* * * * *
(k) The date of the most recent compliance audit, the expected date of completion of any changes resulting from the compliance audit, and identify whether the most recent compliance audit was a thirdparty audit, pursuant to §§ 68.79 and 68.80.
(l) The completion date of the most recent incident investigation and the expected date of completion of any changes resulting from the investigation.
25. Revise § 68.180 to read as follows:
§ 68.180 Emergency response program and exercises.
(a) The owner or operator shall provide in the RMP:
(1) Name, organizational affiliation, phone number, and e-mail address of local emergency planning and response organizations with which the stationary source last coordinated emergency response efforts, pursuant to § 68.10(f)(3) or § 68.93;
(2) The date of the most recent coordination with the local emergency response organizations, pursuant to § 68.93 and
(3) A list of Federal or state emergency plan requirements to which the stationary source is subject.
(b) The owner or operator shall identify in the RMP whether the facility is a responding stationary source or a non-responding stationary source, pursuant to § 68.90.
(1) For non-responding stationary sources, the owner or operator shall identify:
(i) For stationary sources with any regulated toxic substance held in a process above the threshold quantity, whether the stationary source is included in the community emergency response plan developed under 42 U.S.C. 11003, pursuant to § 68.90(b)(1);
(ii) For stationary sources with only regulated flammable substances held in a process above the threshold quantity, the date of the most recent coordination with the local fire department, pursuant to § 68.90(b)(2);
(iii) What mechanisms are in place to notify the public and emergency responders when there is a need for emergency response; and
(iv) The date of the most recent notification exercise, as required in § 68.96(a).
(2) For responding stationary sources, the owner or operator shall identify:
(i) The date of the most recent review and update of the emergency response plan, pursuant to § 68.95(a)(4);
(ii) The date of the most recent notification exercise, as required in § 68.96(a);
(iii) The date of the most recent field exercise, as required in § 68.96(b)(1); and
(iv) The date of the most recent tabletop exercise, as required in § 68.96(b)(2).
26. Amend § 68.190 paragraph (c) by adding a sentence at the end to read as follows:
68.190 Updates.
* * * * *
(c) * * * Prior to de-registration the owner or operator shall meet applicable reporting and incident investigation requirements in accordance with §§ 68.42, 68.60, and/or 68.81.
27. Revise § 68.200 to read as follows:
§ 68.200 Recordkeeping.
The owner or operator shall maintain records supporting the implementation of this part at the stationary source for five years, unless otherwise provided in subpart D of this part.
28. Revise § 68.210 to read as follows:
§ 68.210 Availability of information to the public.
(a) RMP availability. The RMP required under subpart G of this part shall be available to the public under 42 U.S.C. 7414(c) and 40 CFR part 1400.
(b) Chemical hazard information. The owner or operator of a stationary source shall provide, upon request by any member of the public, the following chemical hazard information for all regulated processes, as applicable:
(1) Regulated substances information. Names of regulated substances held in a process;
(2) Safety data sheets (SDS). SDSs for all regulated substances located at the facility;
(3) Accident history information. Provide the five-year accident history information required to be reported under § 68.42;
(4) Emergency response program. The following summary information concerning the stationary source’s compliance with § 68.10(f)(3) or the emergency response provisions of subpart E:
(i) Whether the stationary source is a responding stationary source or a non-responding stationary source;
(ii) Name and phone number of local emergency response organizations with which the owner or operator last coordinated emergency response efforts, pursuant to § 68.180; and
(iii) For stationary sources subject to § 68.95, procedures for informing the public and local emergency response agencies about accidental releases;
(5) Exercises. A list of scheduled exercises required under § 68.96; and
(6) LEPC contact information. Include LEPC name, phone number, and web address as available.
(c) Notification of availability of information. The owner or operator shall provide ongoing notification on a company website, social media platforms, or through other publicly accessible means that:
(1) Information specified in paragraph (b) of this section is available to the public upon request.
The notification shall:
(i) Specify the information elements, identified in paragraph (b) of this section, that can be requested; and
(ii) Provide instructions for how to request the information (e.g. email, mailing address, and/or telephone or website request);
(2) Identify where to access information on community preparedness, if available, including shelter-in-place and evacuation procedures.
(d) Timeframe to provide requested information. The owner or operator shall provide the requested information under paragraph (b) of this section within 45 days of receiving a request from any member of the public.
(e) Public meetings. The owner or operator of a stationary source shall hold a public meeting to provide information required under § 68.42 as well as other relevant chemical hazard information, such as that described in paragraph (b) of this section, no later than 90 days after any accident subject to reporting under § 68.42.
(f) Classified information. The disclosure of information classified by the Department of Defense or other Federal agencies or contractors of such agencies shall be controlled by applicable laws, regulations, or executive orders concerning the release of classified information.
(g) CBI. An owner or operator asserting CBI for information required under this section shall provide a sanitized version to the public. Assertion of claims of CBI and substantiation of CBI claims shall be in the same manner as required in 40 CFR 68.151 and 68.152 for information contained in the RMP required under subpart G. As provided under 40 CFR 68.151(b)(3), an owner or operator of a stationary source may not claim five-year accident history information as CBI. As provided in 40 CFR 68.151(c)(2), an owner or operator of a stationary source asserting that a chemical name is CBI shall provide a generic category or class name as a substitute.