1 Environmental Protection Agency Office of Environmental Information Public Meeting on the Electronic Record Keeping Provisions Of the Cross Media Electronic Reporting and Record Keeping Proposed Rule Thursday, January 17, 2002 Washington, D. C.

[ Tape 1 of 3]

Robin Roberts: ... of CROMERRR, the Cross Media Electronic Reporting and Record Keeping Rule. Just to get a sense of who's come from out of town, can I just see a show of hands to see who's traveled for this meeting? Wow. So most of you have traveled. We appreciate that. We'll try to make this meeting as productive as possible.

I'm Robin Roberts, I'm a mediator with RESOLVE. I'm not an employee of EPA, nor do I advocate for any of their policies. I'm here to ensure that the agenda's honored, that we keep on time and on track.

The purpose of this meeting is to provide you, the interested public, with an opportunity to supplement your formal written comments to EPA with oral comments, and to seek clarification on the electronic record keeping provisions of CROMERRR, Subpart C. The proposed rule was published on August 31 of last year. The public comment period originally ended on November 29 of last year. It's since been extended twice, 2 currently until February 27 of this year. Written comments must be submitted to the docket by that time. Instructions for submitting the comments are in the FRN notice, which is available at the front desk if you don't have it.

There have been two meetings on CROMERRR. We had both of them last year in October, in D. C., and in November in Chicago.

While the focus of those meetings were the entire rule, this one is, just to reiterate, about Subpart C, the electronic record keeping provisions.

At this time, I'd like to introduce the staff from EPA's Office of Environmental Information and Office of General Counsel. Why don't we just start with you, Michael.

Michael LeDesma: My name is Michael LeDesma. I'm an attorney in the Office of General Counsel.

Evi Huffer: Evi Huffer, Office of Environmental Information.

Joe Retzer: I'm Joe Retzer, I'm director of the Collection Services Division in the Office of Environmental Information.

David Schwarz: I'm David Schwarz, also in OEI and one of the co chairs of the CROMERRR work group.

Robin Roberts: In the audience planted among you are other EPA operatives, such as Valerie Brecher Kovacevic and Connie Dwyer, the chief of the Central Receiving Branch. So if 3 you'll turn to the blue sheet, your agenda, I would just like to go over that quickly. In the course of conversations with some of you last month, it became clear that more than hearing from EPA you wanted to engage the agency in a discussion of your concerns about the electronic record keeping provisions of the rule. This agenda is intended to meet your request. After each brief EPA overview of particular areas of the proposed rule, you'll have an opportunity to share your concerns with the EPA panelists.

To foster your discussion, my colleague, Jeff Citrin, and I will have a couple of wireless microphones. Valerie may also be doing this. We're going to do the Phil Donohue routine where you have a question, we'll try to get a mike to you, and I encourage you to speak up into the mike so that your comments do make it onto the record. All comments made into the mike are being recorded. A transcript will be part of the docket for this meeting, for your review. We'll take as many comments as the discussion period allows. I'll try to be flexible with the agenda. If it looks like we're in danger of running over into another discussion area, maybe we can have you jot down your comments and we'll return to them at the end of the meeting if we have any extra time.

Let's just briefly go over the groundrules. When you do speak, please state your name and affiliation, again, for the 4 record. If you could offer your comment on the topic that's being discussed during the time slots indicated on the agenda.

Also, just a note for some of you who may not have done this,

please sign in at the front desk. I'd like to have a complete record of everyone that showed here. If you have questions about the legibility of your handwriting, leave a business card.

So without further ado, I just would like to turn to David Schwarz to begin the first EPA overview on the scope of the electronic record keeping provisions.

David Schwarz: Good morning. Let me add my thanks to Robin's for your being with us here today, particularly for those of you who have traveled from distant places. We really appreciate your taking the time to help us with this rule.

What I'd like to do for about the next fifteen minutes is just go over CROMERRR, focusing in on the part that I think we'll be talking about today; highlight what we understand to be some general issues, and I hope that will launch the discussion.

Later on in the morning, Evi will present some more granular issues to do with the record keeping criteria in particular. Again, the purpose of that is just to help move the discussion along.

I want to start with some general background on CROMERRR.

Most of you are familiar with this, but some of you may not be. 5 Then I want to focus in on an overview of the electronic record keeping part of the rule, which I should say is Subpart C, not D, as we   sorry about that. Then I want to frame what we understand to be some of the general issues.

CROMERRR is meant to cover pretty much the full range of electronic reporting and record keeping under EPA regulations.

This involves a broad range of reports and records under more than ten different statutory programs. It involves a broad range of record retention periods and requirements, from three to perhaps more than thirty years. In addition, as I'm sure most of you know, most of the implementation of our programs is in fact carried out by state or more local agencies. EPA may be one of the first agencies to address the issue of electronic government, where there are implementations by authorized, more local agencies.

Why do we need a rule? Well, we think we need a rule because to actually offer electronic reporting under the Government Paperwork Elimination Act, agencies generally have to do something affirmative. They have to set the standards and parameters under which we accept electronic reports.

Perhaps, although this may not be as clear, it may be that we have to set the standards and parameters under which we allow electronic record keeping. We feel that we want to do this by way of rule making, so that the standards that we do set and 6 that we think are important are enforceable and clear and consistent across our programs and across the country. That's why we are engaging in this rule making exercise.

In terms of applicability, the rule, both the reporting and record keeping side of it, applies to regulated companies reporting to EPA. It will apply to regulated companies reporting under EPA regs but to state or local agencies. It will apply to regulated companies maintaining compliance records and it will apply to states that are implementing electronic reporting and record keeping under an authorized or delegated program. One thing that it doesn't apply to, it doesn't apply to transactions under administrative agreements between states or local governments and EPA. It really addresses the interactions, the electronic interactions,

between the regulated companies, the regulated community, and government agencies.

In terms of core provisions, the rule does more or less the following. To the extent that there are obstacles in the CFR that prevent electronic reporting and record keeping, the rule is intended to remove those. In terms of electronic reporting, the approach is to require electronic reports be submitted to EPA systems or EPA approved systems. In terms of obligations on regulated companies reporting, the requirements really are not much more detailed than that. It does, 7 addressing the states and local agencies, set performance based criteria for state electronic reporting programs. So most of the detail on the electronic reporting side is really addressed to state or local agencies that are implementing our programs.

They aren't really addressed to regulated companies directly.

On the record keeping side, the rule sets standards for electronic record keeping. It ties the approval of state electronic record keeping and reporting initiatives to the general structure of EPA state primacy regs that govern the way that we authorize state and local programs. So that, in a rather large nutshell, is what the rule does.

In terms of structure, it's laid out as follows. Subpart A is the general provisions. Subpart B focuses on electronic reporting, [ inaudible] whether reports are submitted directly to EPA. Subpart C, which is where I think we'll focus most of our discussion today, focuses on electronic reporting criteria or standards for companies maintaining electronic records under EPA regs. Subpart D addresses the state or local government dimension and deals primarily with what states or local governments have to do to be able to offer electronic reporting or electronic record keeping. So that's more or less the structure of the rule. As I said, we're going to focus probably mostly on Subpart C.

So let's move on to electronic record keeping. I'm not 8 going to   sorry, I skipped ahead myself here. In terms of goals, the goals of our electronic record keeping rule are to allow industry to maintain electronic records in lieu of paper records, and for EPA the sort of corresponding goal is to ensure that the electronic records that are maintained by the regulated community are as reliable and trustworthy as the corresponding paper, so that there's no loss in integrity or enforceability as we move from the paper to the electronic environment.

In terms of scope and approach, the scope is very broad.

It's meant to address record keeping by regulated companies and other entities under pretty much all EPA and EPA authorized state programs, although there is room in the proposal to list exceptions or exemptions. That's something that if we continue down that road, we may end up identifying certain programs to be exempt or excerpted from the CROMERRR requirements.

In terms of the approach, the approach is, what we hope or intend it to be, general function based criteria for electronic records that would ensure integrity and authenticity of the records being maintained but would not dictate necessarily particular technologies.

We hoped that our record keeping criteria would be consistent with existing compliance practices and existing electronic record keeping regulations and statutes to the 9 extent that they exist. As some of you may know, the models that we were most cognizant of and that are echoed in the proposal are the Food and Drug Administration electronic reporting and record keeping regs and our own good automated laboratory practices guidance documents. That seems to be the two predecessors that we were most aware of and tried to stay consistent with.

In terms of the provisions, the general provision is that we allow electronic record keeping under any EPA program once EPA or the particular EPA program announces that it's ready to accept or allow electronic record keeping under the regulations that it has authority over. So for example, in RCRA recordkeeping it would be the Office of Solid Waste that might make the announcement that they're ready to allow electronic records under their regulations. The point of that was simply that we didn't want the publication of CROMERRR, either on the reporting or record keeping side, to be like the opening of a floodgate and force the hand of programs that might not be ready to deal with whatever issues had to be dealt with.

That's one of the provisions.

Beyond that, so long as   once a program or once EPA announce that electronic record keeping was allowed, so long as the electronic record retention system met the criteria in Subpart C, it would be in compliance with CROMERRR. It would 10 be an acceptable electronic record. So that's sort of the general provision.

There are a couple of definitions that I imagine we'll be interested in and come back to in the course of the discussion.

One is electronic record, which I believe we took over from the Food and Drug Administration regs. I won't read it to you, but it is very broad, as has been pointed out to us. It may indeed be true that any record that at any point in its lifecycle has passed through a computer may in fact fall under this definition. That's something we can talk about, may be one of the issues. There's also a definition of electronic record retention systems and there's a definition of electronic signatures, and you have those in your handouts and also of course in the rule proposal itself.

Let's sort of focus in a little bit more on Subpart C and get a little closer to the issues. Just in terms of the overview of requirements, Subpart C has three main subsections.

Subsection A gives the criteria for an acceptable electronic record retention system. Subpart B addresses the issue of availability of the system and controls and documentation for inspection. Subpart C adds some special requirements in cases where electronic records involve electronic signatures as a part of the record being maintained.

All of this has raised some general issues, which I'll try 11 to characterize, although you're certainly free in the discussion to recharacterize the issues as you see fit. There seems to be a general issue about current electronic recordkeeping by companies and its relationship to CROMERRR. One of the questions, obviously, is do or could companies' current electronic records, electronic record keeping practices,

satisfy current EPA record keeping requirements. That is,

absent CROMERRR and just looking at the record keeping provisions that are now on the books, do electronic records satisfy those? This may be a question one can ask.

Similarly, on the state level, the corresponding question is do companies' current electronic records satisfy current state program requirements. Then of course, perhaps the most interesting question is how will CROMERRR change the status of current electronic records. So I think those are questions that we will no doubt want to talk about.

A second set of issues goes to the scope of CROMERRR.

Given the definitions, particularly the definitions of electronic record, will CROMERRR apply to most or all records kept for EPA? Our intention when we wrote the proposal was that CROMERRR would apply only to records kept in an electronic record keeping system. The perception, and I should say that the fact that I call it a perception doesn't mean that it's necessarily mistaken, but the perception is that CROMERRR will 12 apply to any record that involves computers in its lifecycle,

even if it is now maintained on paper. To the extent that this is true, this is a very troubling result and, again, one that we'd like to explore how to somehow escape. Hopefully you can give us some help on that.

A third general issue area is, is CROMERRR voluntary,

somewhat related to the previous two questions. The general question is, will companies be able to choose not to comply with CROMERRR standards? Again, our intention when we wrote the rule is that the CROMERRR standards be voluntary in the sense that companies would have a clear and meaningful ability to opt in or opt out of electronic record keeping, as we defined it.

The perception, and perhaps the true perception, is that it may not be voluntary, because given the definition of electronic records, choosing not to do electronic recordkeeping may mean choosing not to use computers at all in conjunction with those records. That just may not be a realistic alternative for most companies. So that clearly is an important issue too.

I guess the last set of issues or discussion points I would throw out to you before we turn things around and hopefully hear from you all, is just the scope of electronic record keeping. There are a number of ways to get at this. I 13 guess we're interested in what kind of electronic records companies currently keep to satisfy EPA regulatory requirements, and how prevalent current electronic recordkeeping is. We're certainly very interested in the kinds of systems that are used to keep those records. And of course,

we're very interested in whether there are important distinctions to be made among the kinds of records that are kept electronically or might be, for example, between the storage of raw data and other sorts of records that involve the information later on in the process.

I'm going to sort of break it there in terms of my remarks, and turn the discussion over to you.

Robin Roberts: Thank you, David. With these questions in mind, which are meant more as prods to encourage the discussion here but by no means to limit it, I'd like to take questions from you here in the audience. What kinds of records do companies currently keep electronically to satisfy EPA regulatory requirements? There may be some of you that interested in responding to that or have concerns about that,

as well as how prevalent are the e record keeping provisions and what kinds of systems are used to keep these records.

Questions?

Evi Huffer: Robin? I would just let people talk about what they want to talk about within this topic. 14 Robin Roberts: Yeah, Evi's just reiterating that these questions aren't the only things here to discuss. They're just meant to prod the discussion.

Frank Miller: Hi, my name is Frank Miller from Rohm Haas Company. Been with Rohm Haas for eighteen years, variety of capacities, manufacturing, engineering and information technology. I thought I'd open this up with just sharing with you two thoughts that are issues that are developing. We're studying this with a cross functional team internally.

I guess the first issue is the issue of the breadth of impact on companies like ours. We use a variety of electronic record keeping systems and electronic systems to do our compliance across all the various media, air, water, waste and so on, to do our compliance analysis reporting and so on. When you multiply that diversity of systems by the number of sites that we have, that causes us some pain in terms of making sure that we could come into compliance with the criteria that's shown here.

My own personal assessment is that there would definitely be some gaps internally between our current system's capabilities and the criteria that have been shown here. So that's one aspect of this, just the breadth of impact across the company.

Then there's the sort of depth area. That's the number of 15 systems that data passes through before you can do environmental compliance. So we have factory floor systems,

those systems communicate then to various other systems for data logging and so on. Those things potentially get passed to business systems. Eventually somewhere up there, in and around the data analysis layer, environmentalists within the company get information from various sources, put that together with business logic and create the analysis and eventually reports.

I can't think of many instances where we're not using electronic systems and record keeping systems to develop our reports. Potentially the report might be paper based when it's delivered, and/ or electronic, but internally a variety of systems and data sources are being used to do the reporting.

The challenge for us is, where do you draw that line?

What is really the electronic record keeping system? So you can perceive that if you're monitoring the opacity of something going up a stack that all the systems that that information passes through potentially are electronic records. So that is a source of concern for us, how deep do we go. So I wanted to share those two aspects of this.

Kathleen Roberts: Good morning, my name is Kathleen Roberts. I'm with the American Chemistry Council. Just to give some sort of explanation or overview, ACC has developed a document that we refer to as the Regulatory Records Retention 16 Requirements document. We finished it and we've published it.

In retrospect, however, we recognize that a number of regulations are missing from this document. For example,

[ Federal Insecticide, Fungicide and Rodenticide Act] was not included. Some of the Clean Air NESHAP requirements were not included. Title V was not included.

Notwithstanding, there are almost 130 separate regulations that require records to be retained. Again, as Frank had pointed out, under the perception or interpretation of CROMERRR, all the data points that supported the reporting for those 130 regulatory requirements potentially would also have to be retained. So a copy of this will be delivered to EPA. I think we might have left a draft copy with EPA at the last workshop. But we do have a list of the requirements as well.

So it is quite huge.

Bruce Adler: Bruce Adler, General Electric Company. GE is a global company with 350,000 employees. To manage our environmental health and safety requirements, we have to use electronic record keeping. Just as one example, one of the items that we track is regulatory required training, of which there were over a million units delivered in 2001. That has to be done electronically. Why? Because it's the only way we can efficiently and effectively and reliably track the information.

If we reverted to a paperwork system to track those 17 requirements, it would collapse. We would collapse, we'd be wasting time and money, and it wouldn't be as reliable.

The whole issue that I'm concerned with with this rule is that by virtue of the requirements you're imposing, to make it like   allegedly like   paperwork you're destroying the one element of electronic record keeping that is so useful, which is its reliability. You're making it more like paper than like electronic record keeping. We could say that if we were looking for 100 percent reliability, so that you could have a perfect audit trail, that we could etch all of our training requirements when they're conducted in stone. That way we'd know if anybody tried to change them. Obviously, we're not going to do that. That's going back to the past, to a less reliable, less effective system. The virtue of electronic record keeping of any form is its effectiveness, is its speed,

is its reliability.

What we're doing here, what it seems like you're trying to do here, is to torque the system to catch that infinitesimally small percentage of those electronic records which might be collected or preserved in a fraudulent way. And to do that,

you're imposing on the billions of other records that are collected, a system that makes it a less effective and less useful system.

Robin Roberts: If there are any comments here to any 18 particular concerns you hear voiced, please speak up.

David Keyes: I'm David Keyes with the Environmental Technology Council. We're the trade association for the commercial hazardous waste industry. I'm still not clear, and it's probably just because I haven't gotten up to speed enough,

on your intended applicability of this proposed regulation.

David, rather than my kind of just making a general comment,

I'm actually going to ask a specific question and see if I can get an answer that helps clarify the applicability of the regulation.

If you think of a typical commercial hazardous waste facility, a landfill or an incinerator, I think of kind of three tiers of electronic record keeping that goes on at that facility. One is, as described by some of the other commenters, electronic data collection that is ultimately assembled into a report that is filed either electronically or on paper, but has that electronic data collection trail behind it. Perhaps some of the requirements you've suggested would be easier to apply at that very high level of collection.

Secondly, there are a variety of regulation required records, like personnel training records, as this gentleman described, where it's all recorded and maintained electronically, subject to frequent change as training is upgraded and new employees are added and so forth. 19 Then there is the layer of almost minute by minute electronic recording of information. For example, when a drum comes in the gate it has a bar code and that drum is tracked through the entire processing at the facility, in its storage,

in its treatment, in its ultimate disposal. The drum itself,

when it's empty, it's eventual discarding is all tracked electronically, because by EPA or state regulation we have to be able to show at that facility where that drum is at any point in time in its processing.

Similar to that are just various monitoring results that are recorded electronically. An incinerator has a literally second by second recording of all its various emissions. Of course, it's really not practical to keep that on paper, or to even produce it on paper. When EPA inspects those records, it typically looks at the electronic records. In fact, a lot of the monitoring data is tied right into EPA computers. They can track the data in their offices, in the EPA regional offices or state offices.

So we're just completely unclear at which layer do these record keeping requirements apply. If they apply all the way down to the most minute data that's collected in enormous,

enormous volumes, that obviously is going to impose tremendous problems for us in trying to comply with all those requirements. 20 So could you answer   I guess, not to go on for too long,

but just as another idea. Your paper says, when EPA announces it's ready for electronic record keeping, this rule will apply.

EPA hasn't announced anything but we're keeping all these records electronically. So I'm not sure what that means either.

Thanks. Sorry for the long question.

Robin Roberts: Would you like a reply to that now?

David Schwarz: Let me do my best and if I mess up maybe my colleagues can help me. You really asked two questions.

One is, what was our intention in terms of the applicability of our electronic record keeping requirements. Let me start to answer that by posing a kind of conundrum to you, which is that we did not, in CROMERRR, actually define the term " record."

The reason that we didn't do that is because our intention was that we wanted CROMERRR to apply to records as defined and specified in the range of so called predicate regulations in the CFR.

So a record may mean one thing under a particular [ inaudible] regs, it may mean something else in terms of Clean Water Act, for example, National Pollutant Discharge Elimination System regs, and so on and so forth. I couldn't sit here today and tell you exactly what record means under each of those regs, because I don't know enough about all the 21 details of all the different programs.

I think that perhaps creates a problem for us, because our intention was that we wanted CROMERRR to apply to those records, as these were specified in the various regulations,

when and to the extent that those particular records were kept in an electronic record keeping system. I don't know, to be perfectly honest, whether that intention as I've articulated it is one that is a particularly clear one, although I think it's only become clear to us as a result of some of these discussions that there is this problem. Record may mean many different things.

We certainly did not mean to encompass all possible records or anything that might be meant by a record, but what exactly we do mean may require that we go back and do more work looking specifically at particular program regs. I don't know if that answers your question, but at least shares our sense of the problem.

In terms of the idea that individual EPA programs would announce that electronic record keeping was turned on, again,

all I can do is sort of explain to you the assumptions under which we were working when we wrote that, which turn out not to be valid. Which is that we assumed that generally, except for rather specific, a handful of programs where electronic recordkeeping had been specifically provided for, our assumption was 22 that companies were not generally keeping the records required under the program regs, however those are defined.

Our assumption is that those records were not being maintained electronically. What you all have been telling us here today and at previous meetings is that assumption is not true. So clearly, that provision of CROMERRR will have to be changed or dropped.

It looks as though electronic record keeping generally,

and this is where my Office of General Counsel colleague may want to jump in, but it looks as though in general electronic record keeping is not clearly prohibited by existing regulations, except maybe in some special cases where there are specific references to paper or paper related things. If that's the case, as it may well be, then we're starting at a different point in the evolution of the transition than we thought we were and we'll have to say different things.

Michael LeDesma: I can just add a little bit to that. I think   one of the questions we've heard often is why do you even need a rule to allow electronic record keeping when it's clear that under many of your programs, in fact, electronic record keeping is currently being allowed. I think that when we look at this rule, like many of the other rules that the agency promulgates, there're really two components.

One is an interpretive component and then there's a 23 legislative component. For some programs in the agency, the agency has, as a matter of just fact, accomplished that interpretive step through guidance. But in most instances it hasn't. So there is an interpretive step that needs to be made before electronic record keeping is " turned on." In addition,

and what's creating a great deal of the controversy, are the legislative elements, the provisions that we see in Section 3.100 of the rule.

So there are really those two components. I think the intention of this rule is not to speak to current recordkeeping but to make clear that we are doing this interpretive step and, in addition, this legislative step, so that it's clear for everybody what the rules of the game are going forward.

Rich Lysakowski: I'm Rich Lysakowski from two organizations, actually, the Collaborative Electronic Notebook Systems Association and the Global Electronic Records Association. I've been studying this problem since about 1991,

and what it takes to replace paper notebooks and notebook systems with electronic records. We've come to some basic conclusions that computer systems are not record keeping systems, they're data systems.

Data is not equivalent to a record, and you have to be pretty formal about how you define what is a record. That is, 24 a record is something that is converted to a preservation format that will outlive the computer systems of today, and set aside under the duty of care of a custodian who has accountability and responsibility for preservation of that record.

CENSA, Collaborative Electronic Notebook Systems Association focuses on two things; one is regulatory compliance, because notebooks are used for regulatory recordkeeping The second is intellectual property protection, which is an even more stringent   when it comes to litigation, the litigation is a free for all. It's not a well ordered type of litigation you encounter with the Environmental Protection Agency. It is a total free for all, going for the throat, this is my intellectual property and I'm going to get it no matter what. So that's a different kind of record keeping, requires an even higher level of integrity in the whole process, from beginning to end.

The way the rule is written now, I implore you to define a record as a record, not the way it's defined here as anything created by a computer system. That is, first of all focus on converting it to a preservation format, something that will outlive the current computer system that you bought tomorrow,

which was obsolete yesterday.

First and foremost; this is critical. Do not equate 25 computer systems to records retention systems. Do not equate people who create data to a records manager or an archivist,

that is, someone with the duty of care for records to be retained for as long as they're needed by the business.

We found this   in CENSA we have a lot of pharmaceutical companies, we have tons of money to pour into the [ Federal Drug Administration] Part 11 legislation. We have some of your companies represented in CENSA as well, if you're a chemical company. We found that it just takes a lot of time and money to bring any system into compliance. It's not just the hardware and software, it's your whole program of people,

policies, education, training and all of those things.

If you don't start upfront with using the right definitions, given the way computer systems have been designed,

they're not designed to be records retention systems. They're used for just capturing and processing information and data.

And data and information are not the same as a record. If you look at the most formal definition, that is, one used by the archival community, it's something converted to a preservation format and set aside for the purpose of preservation for as long as needed by the business. So there's some fundamentals that ought to be put in here.

If you're going to keep the rule the way it is, I suggest you change the name to Electronic Evidence Rule. Because this 26 is indeed the heart of the matter, that yes, the way you've defined electronic records is anything coming from a computer system. The way that evidentiary discovery is done is anything from any computer system. Correct? It's all evidence, no matter where it is, no matter what form. So include in there electronic evidentiary discovery aspects of it.

Don't call it just records, call it evidence, because that's where we got a lot of confusion in trying to comply with Part 11 from the [ Federal Drug Administration]. The [ Federal Drug Administration]' s rule was not about records, it was not about things created, converted to a preservation format and set aside under the duty of care with somebody who knows how to do that. It was really about evidence, anywhere and everywhere, and going after that evidence for the purpose of criminal prosecution, for the purpose of demonstrating fraud.

That's really what this rule, that's one of the things this rule is intended to do is to cover evidentiary discovery for prosecution.

So that should be made clear too, that this is about electronic evidence, it's not about electronic records. It's not only about electronic records. It's about reporting to the EPA, it's about taking records from computer systems and putting them into record keeping systems or records retention systems. It's about permitting EPA to come in and do 27 evidentiary discovery for purpose of prosecution. But a few fundamental changes, and one even includes somewhere in the name the word " evidence," not   [ End of Tape 1, Side A; Side B begins]

 or information. I'm not really quite sure, because I can't get a straight answer from my records manager or someone like that, someone qualified. So this issue of duty of care for preservation comes in. That needs to be really clear in the rule. With a few fundamental changes, you can set expectations properly as to what it will take to comply with the rule. It's a much bigger issue than you really understand at this time. It's taken us almost ten years now to really fully understand the implications of trying to throw away paper for high consequence and high value records. It's not about the name, it's about the processes of evidentiary discovery,

that we found that are critical.

There's attorneys sitting in this room who will never move away from paper until they have the same kind of comfort and confidence in " computer systems," that they're equal to recordkeeping systems, because they're not, not the way computer systems are designed today. I can't read Microsoft Word Version 2 files with Microsoft Office 2000. It's simply unavailable as a converter today. So the software and the formats are also a critical issue. 28 Jonnie Martin: My name's Jonnie Martin, I work for a downstream oil company that you've probably never heard of, but it's a Shell Texaco joint venture called Equilon and Motiva. I work for Equiva Services, which is the central EHS organization. We manage environmental regulations for nine refineries, over a hundred petroleum distribution terminals,

several thousand service stations and thousands of miles of pipeline. In our company, everyone has a computer, everyone.

This rule would have a significant impact on us for a couple of reasons. One, because my office is in Houston and we have severe air problems in Houston, as most of you know,

companies there are being encouraged strongly to go to telecommuting. My company is fixing to institute a strong telecommuting policy which would allow us to work from home three, possibly four days a week, and only come into downtown Houston, which would be a blessing, once a week.

To do that, we're spending several hundred thousand dollars, perhaps millions, I don't know the total cost, but I know it is significant, with our Intranet web site. The company aims that that web site will be used by all of us to do our work from home. So therefore all the environmental information has to be in the computer and has to be accessible to every employee who's working from home, to every refinery,

to every terminal, to every pipeline operator. 29 The rule, as it is now written would cost us significant amounts of money, if we could even comply with it, and quite frankly, we don't think we can. So I would very much agree with the gentleman over there. Your definition of electronic record is so broad that it captures everything we do now. I would urge you to reconsider this one.

Howard Krueger: My name is Howard Krueger from Procter &

Gamble Company in Cincinnati. I have worked in the regulatory affairs field for twenty eight years and have worked in the legislative arena, the regulatory arena. I've been before Congress, regulatory agencies and the courts. I'm very familiar with definitions and how they're interpreted.

The brief comment that I have really for Joe, I want to play back the comment that Joe made where he said that they,

meaning the EPA, had not provided a definition of record. What I'd like to alert you to is the very high likelihood that in fact you have. I'll explain it. You have clearly defined an electronic record, and if you take off the word electronic and if you remove the last four words, which are " by a computer system," you have in fact defined a record, and I'll read it to you. It's right here in your definition. " A record is any combination of text, graphics, data, audio, pictorial or other information that is created, modified, maintained, archived,

retrieved or distributed." The only thing that makes it 30 electronic, putting the word electronic at the beginning, are the last four words that say " by a computer." So I would just caution you in thinking that you haven't defined a record, just because the word record doesn't appear by itself. I would say that you have. Then when you define electronic record of course you use the big four words, " by a computer system."

Jim Scialabba: I'm Jim Scialabba with Marathon Oil Company. One issue with this proposed regulation that I have not heard brought up yet in any public forum or in any correspondence I've seen is the implications on this rulemaking for the relationship that we, the regulated community,

would have with all government entities because a lot of the information that's gathered is gathered by our field people,

our technicians, our managers, who aren't environmental professionals. They gather information also that is passed on to or which we need to submit to, for instance, OSHA and Department of Labor, U. S. Fish and Wildlife Service, Bureau of Land Management, MMS, Army Corps of Engineers, U. S. Coast Guard, National Marines Fishery Service and[ the National Oceanic and Atmospheric Administration], in addition to state agencies that are environmental agencies or analogues of federal agencies.

A concern we have is that this rule making is going to set a standard that's going to change the relationships, reporting 31 relationships, with all of these agencies. Because we're not going to create, for instance, us, who like everyone else in the room is heavily dependent on electronic management of information now, we're not going to set up a system that's only going to comply with EPA. We're going to have [ inaudible] set a standard that will work across the company because our people want to use a single system, as we've gone to a single word processing standard in the company.

I really think EPA needs to consider this. If you haven't talked with your colleagues in the other government agencies, I really urge you to sit down and have a discussion about this very broad implication.

James VanHorn: I am Jim VanHorn with Smurfit Stone Container Corporation. The question was, how is this going to affect and how much record keeping do we have being covered by this. In our company, there is a definite push to get all the records. It includes such things as our financial records,

quality records, production records, human resource records,

our purchasing sales and of course environmental. An awful lot of these indirectly are the initial sources where data is collected. It ends up in a report.

As an example of how this is going to affect us in our company audit, today it is rather easy to get money and material to store in electronic record keeping. But if you ask 32 for a new file cabinet, they look at you like something that's crazy. So it has a tremendous effect on us, it can affect practically everything we do, is that we're totally going towards the electronic record keeping, documentation,

everything we do. So it will affect everything that we do in the whole corporation.

Maria Angelo: I'm Maria Angelo, I work for DuPont. I'm in our corporate solid waste consulting group. I'd like to thank you for the opportunity to talk this morning and discuss these issues. I'd just like to reiterate the comments that other folks from industry have been saying with respect to the prevalence of the use of electronic records today. Even if you try and narrow your definition to focus only on records as they apply to specific programs, they're still used extensively to support permits, to support records.

Just to reiterate what this gentleman said with respect to the origin of the systems, I know at one facility in the United States I counted   in ten minutes I was able to come up with over three dozen different systems that are used to support the collection of information for environmental compliance. That doesn't cross into some of the other program areas that have been mentioned or some of the other business programs that have been mentioned, and that's only one facility. Certainly each facility does a lot of hybridization and uses different 33 systems, so the scope is just massive.

Mark Duvall: My name is Mark Duvall with the Dow Chemical Company. The initial question was, what kinds of records are kept electronically by our companies and what kinds of systems are used. Dow, like the other companies that have been mentioned, uses many kinds of electronic systems for many different purposes. For our compliance with EPA recordkeeping virtually everything we do is at some point electronic. Sometimes things are printed out, but to a large degree they are not. Virtually nothing that we do is not at some point electronic.

It's interesting to note that the cost benefit analysis that was done for this rule suggested that annually 428 facilities in the United States would choose to subject themselves to this rule. That suggests that there's a fundamental misperception here, that electronic record keeping is at the dawn of its use in the American economy. It's obviously not the case. At one Dow facility, for example, over a million data points are collected annually. Air emissions,

water emissions, these are data that can only be collected by computers, can only be stored by computers, can only be manipulated by computers. The idea that we would even choose ever to print them out is not only inefficient, but we wouldn't know what to do with the paper, because we couldn't use the 34 data other than in electronic format. Electronic recordkeeping is the norm, it is pervasive, it is throughout Dow and I would suggest throughout all facilities that are regulated by EPA.

How do we keep electronic records? The answer is, in lots of different ways. There is no standard way that we use electronic records. Our agricultural chemical subsidiary, for instance, uses some 180 different systems to collect electronic data for laboratory and field studies. We have over ten thousand laboratory instruments, many of which are standalones Our R& D function has a diverse computing architecture that has almost every kind of proprietary system out there being utilized. So we have Windows and we have UNIX and inhouse systems. There is no standardization, and frankly that sometimes gets in the way as we try and move data from one system to another system.

But if the question that EPA is asking is, is there a way that records are kept one way or a few ways that records are kept such that a rule could be tailored to address those systems, the answer is no. There are many, many different systems used today and there is no standardization to them. A few things that could be said about those systems, however, is that they were not designed with the CROMERRR record keeping requirements in mind, so that for example, an audit trail 35 capability will sometimes be found in these systems but generally will not be.

One reason for that is that the functionality is not needed, it's not a business need. You don't want to pay for a feature that you didn't need. As a result, all of the infrastructures that we have lack the capability of meeting the CROMERRR requirements.

In addition, the whole point of electronic record keeping,

the whole point of using computers, is to increase efficiency.

To the extent that the kinds of data that EPA would like to see retained in the form of audit trails, what the effect of that would be a tremendous increase in the memory requirements,

because so many more data points would need to be saved.

Memory is expensive. It is one of the single most expensive aspects of the computer system. When, as Dow has,

you have very large systems with very large quantities of data,

to have to exponentially increase the amount of data kept and then keep it for considerable periods of time, the memory costs themselves are a very significant aspect of the cost of meeting the CROMERRR electronic record keeping provisions.

Pat McConnell: I'm Pat McConnell from DuPont. I just wanted to add one additional piece to what this gentleman just said. The most impossible piece of this is you were talking about individual applications that do audit trails. Almost all 36 of our companies don't use one application to get data from Point A to Point B. Lots of times the data collection system doesn't do the analysis, doesn't do the reporting.

One thing that is not possible, that we cannot force the vendors to do, is to create the means by which to produce audit trails between the systems and interfaces between the systems that provide or meet the guidelines in CROMERRR.

Patricia Runge: I'm Patricia Runge and I work at Experimental Pathology Laboratories in Virginia. We're not involved in a lot of the larger scale applications that CROMERRR would bring to our industry. We're toxicologic pathology. But a lot of the same applications apply with the electronic record keeping and electronic generation of data.

But one thing that I don't get from anybody, either from EPA or from [ Federal Drug Administration], is how hybrid systems are going to be considered in this application.

For many smaller companies, that includes environmental as well as toxicological companies, a lot of their data is not generated by a computer but it does go through a computer system for reporting purposes and for data retention purposes.

There are not enough guidelines as how this type of application needs to be addressed.

Austin Perez: Austin Perez from the U. S. Small Business Administration's Office of Advocacy. The gentleman from 37 General Counsel earlier addressed I guess the need for the rule and I wanted to address this question to you. I've been told,

and I'm hearing over and over again, that electronic recordkeeping is widespread. I believe you were making a legal distinction that the fact that it's being allowed was allowed through guidance rather than through a change of the law. I guess I'm curious. I guess what you're suggesting is that if you don't do this rule, I guess to turn on the ability to record keep is a problem. I would like to know, what are the consequences if this rule does not go into effect, in all those situations where electronic record keeping is allowed today?

Michael LeDesma: I guess there's probably   I'm not sure what the programmatic consequences are, although I suspect that what you'd end up with if the agency were to proceed in the absence of a rule like CROMERRR is that each program would design its own set of   each EPA program, in fact each federal agency program that somehow affects a regulated entity, would develop its own electronic record keeping requirements, that they would require through guidance. Then, of course,

companies such as yourselves would be or the companies represented here would be in the position of having to comply with that multiplicity of different systems. So I think one of the motivations behind CROMERRR was to create a unified set of record keeping requirements. 38 As a legal matter, I'm not going to speak to what the   I'm not going to speak generally to ongoing record keeping practices throughout the agency. I don't know about them in sufficient detail to speak one way or the other. But I will say as a general matter that the agency can allow electronic record keeping, in fact there are several regulations that the agency has where it says that the agency, the administrator can designate an electronic record keeping system. So we can. The fact of the matter is that we haven't done so in any sort of widespread, coherent sort of way. So that was the intent of this rule.

Howard Krueger: Howard Krueger, Procter & Gamble. I wanted to respond with some more examples of specific records.

I think it is helpful to really come to grips with exactly what's involved. I have this in text form and I'll give it to you at the break. Under the broad definition of an electronic record, our company cannot identify a single instance where some aspect of the compliance records creation or modification,

maintenance, archiving, retrieval, distribution, does not involve a computer system.

We currently keep hundreds of thousands of electronic records each year under [ the Federal Insecticide, Fungicide,

and Rodenticide Act, Toxic Substances Control Act], Clean Water [ Act], Clean Air [ Act], [ Comprehensive Environmental Response, 39 Compensation and Liability Act] and [ Resource Conservation and Recovery Act]. Specific examples of the kinds of records,

which was the question that was originally asked, include analytical data and summaries, product performance data and summaries, testing protocols, animal and human subjects testing and summaries   speak to the point made over here. [ Good Laboratory Practices] GCP compliance information, production records, raw material receipt and usage, [ Quality Assurance]

records, production data, training records, import and export compliance records; entire databases of miscellaneous information which are subsequently used to conduct and support compliance assessments; domestic shipping information and many other hundreds of thousands of records.

In addition, examples of the electronic records specifically created and maintained at our manufacturing facilities include emission or surrogate emission data from a distributed control system, and that is a sensor combined with a computer that automatically records the data. Continuous emission monitor data, computer generated documents and spreadsheets used to calculate and document emissions data.

Chemical use inventory, records under [ the Toxic Substances Control Act] IUR, which are taken from electronic materials management systems. Environmental logs are created from instrument data, which is often averaged over a compliance 40 period and recorded on an electronic log.

So in summary, virtually all of our records are in fact electronic records. We cannot identify how the CROMERRR rule would not impact this entire universe of our electronic recordkeeping system and the records that we have.

Charles Reese: Charles Reese with BASF Corporation. I just agree with Mr. Krueger of Procter & Gamble and several of the other people here that the kinds of records that companies currently keep, virtually we keep all records electronically or they pass through some sort of electronic record keeping system at some point of their life. If you were to look at just Part 160, there are 57 required records inside of simply Part 160 under Title XL. Companies like to use computers and electronic records extensively to take advantage of efficiencies wherever that's possible. Examples of these types of records that are ideal for maintaining electronically could be anything from standard operating procedures, personnel training records,

master study schedules, draft reports, calculation reports.

Even raw data can be generated and maintained electronically under the provisions of the Good Laboratory Practice Standards.

BASF is a large, multinational company. We have many diversified business groups that have different applications and responsibilities under EPA's Title XL environmental regulations. We recognize the need for regulations and 41 guidance around these practices concerning electronic reporting and record keeping. At this time, though, we feel that the record keeping portion of the proposed rule should be withdrawn. The reasons for this opinion are four statements.

I'm going to give you this text at the break.

As it's written, the CROMERRR proposed rule is not voluntary. It would be mandatory for any EPA regulated entity that currently generates an electronic record. The number of entities affected and the cost to develop compliance procedures are grossly underestimated. Estimates run as high as 1.2 million entities affected immediately, and could have an effect on the economy ranging from anywhere from $ 48 billion, and then we've heard as high as $ 1.8 trillion. This differs greatly from the 400 average number of facilities per year and the $ 40,000 average per facility cost to comply.

Third, there's no differentiation between types of electronic records, but rather a one size fits all approach for all of the electronic record criteria. This approach gives no consideration to the vastly different types of systems currently in use to adhere to Title XL. Finally, the rapid changes in technology force a huge burden on maintaining an electronic record for a long record retention period, which in some cases can last, as you said, decades, up to thirty years or more. In this case, would actually be indefinite. 42 Robin Roberts: If possible, we have set aside a time on the agenda to talk to this whole issue of decoupling Subpart C.

I would just beg your indulgence and try withholding comments on that until we get to that section.

Kathleen Roberts: Kathleen Roberts, American Chemistry Council. David, perhaps you can help me with this. A couple slides back you talk about the scope of CROMERRR and the intention was CROMERRR would apply only to records kept in an electronic record keeping system, and then the perception,

which is the one that we've all reiterated here, that in fact we're reading it to mean every piece of data collected in order to comply.

I'd like, and beg my indulgence if you would, can you redefine electronic record keeping system? Because the way that it's written right now, quite frankly, I just don't get it. The way it's written right now says, " any set of apparatus, procedure, software, records or documentation used to retain exact electronic copies of electronic records."

Electronic and record is repeated a couple of times in there,

so I'm just not really sure what it is exactly that means.

David Schwarz: I don't think I want to try to redefine this on the fly. I think this was also something that we borrowed from [ the Federal Drug Administration]. Let me ask you, is there   43 Kathleen Roberts: I guess what I'm wondering is, when you guys talk about record keeping systems and whether they are or are not allowed by EPA, and obviously many people here are keeping records electronically and so we're all kind of at angst going, what exactly does this mean? When you say EPA may allow electronic records, do you mean electronic copies of the reports? Is that what we're referring to?

David Schwarz: No, no. I think I can answer this question. Under most EPA regs that involve some sort of informational requirement, there's pretty standardly a distinction between data you actually have to submit to EPA,

that's the report, and things that you have to maintain at your facility, which you may never have to submit but you might for example need to make available if an inspector calls. The record keeping requirements are meant to pertain to those things that you have to maintain at your facility.

There is, I suppose, an overlap in the sense that very often one of the records you have to maintain is a copy of the report that you submitted, although not always. So there's that overlap. But the record keeping is meant to focus on what you keep at your facility and don't submit to us.

Kathleen Roberts: So those records that you are required to maintain for EPA.

David Schwarz: Right. What they are really varies widely 44 from program to program, as you know, I'm sure.

Kathleen Roberts: Agreed. Okay, then I guess, as has been stated many times, I think we need to reiterate what the definition of record is and if it requires a separate definition for each regulation, maybe that is something to consider.

Henry Bartholomew: Henry Bartholomew of the Edison Electric Institute. Just to speak to the issue on the table at the moment, I would also say that for electric utilities,

electronic record keeping is very pervasive and we're certainly affected by many of the programs EPA administers and a lot of our company monitoring and reporting is done electronically. I think, although I know you want to sort of divide this into little subpieces, as I listen to the discussion this morning and your presentation and I've read the preamble to the rule while I'm sitting here, it's about trying to have trustworthy data keeping.

When companies file reports, they're required to file, or if they have an inspector on site taking a look at what's happening on a particular site, the issue of trustworthiness is inherent in the filing of the report, when they sign off on that report, whether you have a paper trail behind it or an electronic data keeping system. With things like the U. S.

Sentencing Commission guidelines and EPA pronouncements in the 45 various program areas, most of our companies have very advanced environmental compliance systems in place that a part of which is the electronic record keeping, but it's just a part of it.

This feels like that tail trying to wag the dog.

If EPA has identified specific concerns that it wants to address, rather than trying to revamp the entire electronic record keeping system that many companies have been putting in place at many hundreds of thousands of dollars over the past couple of decades since computer technology really became available, let's look at what are those specific concern areas and let's address those much more individually. Individually may mean if you have a bad actor company, you may deal with it directly in that case by imposing some restrictions on that company. But as a general matter in terms of major U. S.

industries in the U. S. economy, it seems like this is a very upside down approach to trying to deal with that issue of reliability and so forth. When a company files a report and signs off on it, it's standing behind that, presumably. That's just an observation, thanks.

Kathy Barrowclough: Kathy Barrowclough, DuPont. I'd like to go back to what Ms. Roberts was just saying around the exact electronic copies in electronic record keeping systems. That's been a question of mine. The electronic records requirements that you spell out, the different ones that you have for audit 46 trail and that sort of thing, according to the rule apply to those records that are maintained in an electronic recordkeeping system. Then if you go back and look at the definition of an electronic record keeping system, it refers to records that are exact copies of data. When in reality a lot of our record keeping systems are the original raw data, they are not copies. So the question is, what are we applying to? Are we applying to all of those data collection systems or are we only applying the electronic record keeping portion or rules to those systems that we have set up to maintain in an ongoing way those copies of those original records or original data points?

Robin Roberts: We're going to take one last question and then there's been a request for a quick break after this question. I'd like to have you back here in ten minutes. The doors will be locked at that time.

Bruce Adler: I want to return to the issue that Mr.

LeDesma addressed earlier, and that has to do with the present status of electronic records. I'm certainly in favor of consistency between the programs as to how they approach electronic record keeping. But the thrust of your words implied that without CROMERRR and without guidance from the various program offices, there's some sort of impediment to electronic record keeping. I'm not sure that's the case.

Absent a specific prohibition on tracking records 47 electronically, I don't think that the agency can say we can't do that. Just like the agency's rules do not currently distinguish between keeping records with a pencil or a pen or a manual typewriter or an electric typewriter or a word processor, there's no prohibition on keeping them electronically. So the implication that absent CROMERRR and absent guidance from the program offices that electronic records can't be used, I think is just wrong.

Robin Roberts: Great. With that comment then, we'll break now before we take up the overview on the general criteria for the record keeping provisions. So I could have you back here in ten minutes, that's 11: 35.

[ Break]

David Schwarz: I want to sort of drill down to the specific criteria in this part of the discussion. These are the nine criteria. I'm not going to go through all of them in detail, I think probably you're pretty familiar with them. For whatever it's worth, I guess my feeling is that some of them are reasonably straightforward and perhaps not quite so controversial. For example, the first one, " generate and maintain accurate, complete records in a form that cannot be altered without detection." That may or may not be something that's easy to comply with, but the general idea that one should maintain accurate records and that there should be a way 48 to detect if they've been messed with or doctored, is I think reasonably straightforward.

Some of the others I know are more controversial. We are going to focus on the archiving and the audit trail criteria specifically this afternoon.

There have been, in past meetings and comments, a considerable amount of focus on those, and so we do want to devote some time specifically to them.

In the case of records with electronic signatures, there are some additional criteria. We feel that where the signature is present there should be some information to allow someone reading the record to determine what the signature meant, whose signature it is, date and time, things like that. And there should be a way to link the electronic signature to the electronic record in a way that ensures that it's bound and cannot be pulled apart, it cannot be excised or that ideally what's signed can't be changed without in some way invalidating the signature. That's pretty much the criteria. I'm sure we'll talk about some of these points in more detail.

Just one last slide in terms of discussion. Some of the questions, but by no means all of them, that we like to have talked about here are, first of all, which criteria are the most difficult to satisfy with existing systems. I guess to the extent that people can be specific about what in particular 49 causes the problem I think would be very helpful to us.

Similarly, if some criteria pose particular problems for certain kinds of records, I think that would be useful.

People have pointed out this morning and in other sessions that there is a problem with a one size fits all approach, and if you can tell us where in fact this one size does not fit,

again, I think the specifics would be very useful.

I think a third question is, if in fact these criteria are not ones that you currently adopt and satisfy, we would be interested in knowing how you currently do assure yourself and other people who are interested that your electronic records are in fact accurate and reliable and have integrity. We're very interested in alternative sets of standards to these things, if you could propose them. Then I guess if there are unique issues that you see associated with electronic signatures that form a part of electronic records, we'd certainly like to hear that as well.

So that's at least some of the questions that we hope you'll respond to. Of course, any others that you are interested in talking about.

Robin Roberts: Good, so this is a little more narrowly focused section. We've gotten to the depth and the breadth of a lot of the issues here associated with record keeping and also with record retention. If in this section we could try 50 and be a little more focused on particular general criteria,

that would be great, and it's also a chance for you to let EPA hear about how you manage your record keeping systems and what are some of the problems you've encountered that would inform your development of a realistic rule.

Mark Greenwood: My name is Mark Greenwood and I'm with the law firm Robson Gray. I represent something called the Coalition for Effective Environmental Information. Actually,

I'm afraid I'll divert a little bit from the specific question point if I could, because I think in listening to the discussion this morning, I think following this rule making, I think we're struggling with the difficulty of trying to sort through three different constructs for what the agency is trying to achieve. If I could just go through that I think it might be helpful, at least it organizes things for me, if it doesn't for others.

I think the agency is in some sense trying to, really under the authority of [ the Government Paperwork Elimination Act], which is the statute which is supposed to allow and permit record keeping and reporting to be electronic, to somehow do something that makes it clear that that's allowed.

I heard Michael saying that there was this interpretive function to make clear in a rule that things that people have been doing for many years are okay. I think that is a function 51 that they're trying to deal with here, and I think that is a separate issue from two others.

The other theme I'm hearing here is they're concerned about fraud in how documents are prepared and perhaps modified over time. I would suggest that's a very different problem,

and I think there's a lot of folks who have strong feelings about what is the nature of that problem, whether it is a problem, and so on. I think it's very important to focus initially on what is the nature of that issue, if there is one,

because it drives everything related to solutions and obviously paths forward for the rule.

The third one, which is this issue of long term record retention, which I think people recognize is an issue. How you manage it, frankly it's a problem not just for the private sector, for the government as well. It relays a lot of questions about what are the records and why do we retain them for such a long period of time. Again, a distinct set of issues and problems that I think should be thought through on separate tracks.

So while I know, I suspect we'll have a very open discussion about many of these issues here, I think it's helpful for us all to keep in mind that we have three different problems that will define both what is the issue, what is the solution and what is the path forward as we go through today. 52 Robin Roberts: Great. Any organizational scheme for all these ideas that are flowing is a good idea. Are there any questions on the general criteria of the rule that you'd like to speak to? Any experience with record keeping in your corporations that you'd like to share?

Frank Miller: Frank Miller again, from Rohm Haas Company.

Just to give you ideas for some comments back on the various criteria.

So four comments. On the systems that we have in general,

whether they're used for compliance and/ or business systems and so on, in general the first point, being able to absolutely detect any times that data could be altered, most systems aren't really designed that way. They're secured and there's various roles of who can do what and role based security as systems have evolved, but to absolutely detect when any changes are made and so on and that records haven't been altered, most of our systems aren't really designed that way. So that's the first aspect. There's definitely a gap between maybe what your ultimate disciplined intentions are here and what we could probably do today.

The second area is around audit trails, time and date stamping and so on. Some systems have those, many business systems have it so that you're not really changing the exact information, you're doing incremental changes to it and have 53 some kind of time and date stamping. But by and large, most of the environmental systems don't have too much of that, and/ or if they use business systems, they inherit some of that. But in general, most systems weren't designed that way and that's not usually there, so we'd have to find a way of bringing,

again, coming into compliance. So that's point six and seven.

Point eight, around searching and retrieving. Probably most systems today are starting to adopt knowledge managementtype principles where you want to be able to find things easily and fastly and have keyword criteria and various ways to get at information. But again, not too many systems are there yet, so again there's a gap. It'll take us a while to come into compliance.

Then around the archiving in electronic form, there's two parts to that. The storage media itself, so there's storage media obsolescence. There's the challenge of always being able to have it on the right media so that you have that equipment to be able to bring it back if someone needed to see it.

Then the application obsolescence  that's being able to have it on a platform where you have people who know how to run that platform and know how to understand the application,

understand business logic and could actually run the application ten years later to be able to understand how that record was actually generated. 54 So again, those things are a challenge for us today. We don't have real good answers for those. The storage media, we do bring things forward and so on, but there's always the issue of the first recording of data and how do you   you can validate data as you move it, you can validate applications as you move it, but there's always the issue of now you've moved beyond the first   [ End of Tape 1, Side A]

[ Tape 2 of 3]

 those are some feedback on those criteria.

Rich Lysakowski: If I look at the list of   I would assume these are functional criteria for electronic records retention system. You've got nine commandments there. Going back to biblical terms, there's usually ten. If you could just add one, and that is, convert records to a documentary record form that permits facile   in quotes, I have facile means low cost   migration of records before the underlying technology becomes obsolete. Then you would have a complete system for records retention. The things that he's talking about are programmatic elements that are people, policies, procedures,

not technology functional requirements.

So adding a tenth part to that, convert records to a documentary record form that permits low cost migration of records before the underlying technology becomes obsolete, 55 would give you a complete functional description of the system,

at least from the technology point of view. That's the real issue around retention, is the rapid obsolescence.

Today that's by design, so that you are forced to upgrade to the next version of software. Vendors really make that difficult for you to do facile conversion to some preservation format that makes migration easy. That's where your real cost comes in over long periods of time with electronic records systems, is because vendors make that difficult on purpose.

Unidentified Male Speaker: Or maybe it's really Bill Gates that makes that difficult.

Pat McConnell: I'd like to add just one dispute to that,

and I'm not sure if I'm crossing over into this afternoon. But long term, thirty years from now, do you know how many versions of how many systems of how many instruments of how many software, and if they have to be converted I won't have to do it, I'll be retired by then. But if every form of that has to be converted, that becomes massive in itself.

Charles Reese: I just want to add a comment to the gentleman from the computer notebooks. This is the [ Good Laboratory Practices] consensus document, the application to the principles of [ Good Laboratory Practices] to computerized systems, by the [ Organization for Economic Cooperation and Development], series on principles of [ Good Laboratory 56 Practices] and compliance monitoring. In this document, they actually give commandment number ten, " where system obsolescence forces a need to transfer electronic raw data from one system to another, then the process must be well documented and its integrity verified. Where such migration is not practical, then the raw data must be transferred to another medium"   medium being a key word here   " and this verified as an exact copy prior to any destruction of the original electronic records."

The tenth commandment needs to be a medium. A medium doesn't have to be paper. It could be paper. It doesn't have to be a computer format. It could be a computer format. But the key is medium. When something is electronic, we're trying to store it as a record, and it becomes obsolescent, we need to have the ability to move that record to some medium. Our choice in [ Federal Insecticide, Fungicide and Rodenticide Act],

up until this point, had been paper. The way we see these definitions of electronic records is going to make our paper systems   we will no longer be able to say that our original raw data is the paper printout, because the electronic record is first.

So my question here is actually to the panel, is more the issue of fraud. I see here in this list of the nine commandments things that seem to point to how to maintain these 57 records with integrity over periods of time, but there's nothing there to say that how the records were generated in the first place. Were they   is the record accurate or is it maintained properly. So I guess the issue here is validation.

So how is CROMERRR going to address the fraud   is there some sort of feeling that without CROMERRR that the ability to perpetuate fraud is greater or less? I wonder how you plan to address these things and how come we're not addressing whether or not the data is actually accurate versus how long we maintain it, or how we maintain it. Just open to the panel.

Unidentified Male Speaker: I guess I'd say two things about it. One is, the first one does say generate and maintain accurate records. I think the other thing is again, we're looking at the underlying program requirements to describe what record you have to generate and how it can be generated.

Whether it says you can use a CEM or whatever it is. Usually the underlying program records requirements describe that. So that's why we didn't address the generation, the initial generation of the record here, other than the more general statement that you have to generate accurate records.

Unidentified Male Speaker: Does that answer your question?

Charles Reese: Yeah. So you're saying that the individual programs here have their own requirements for 58 generating, the way they generate an accurate record, but if we're all generating electronic records, are the programs then going to have to address individually how to generate an accurate electronic record versus   then we have to rely on CROMERRR to how we maintain and migrate that electronic record.

So wouldn't it seem prevalent to have some sort of validation concept in the CROMERRR? Because you're right back to what it seemed like you were trying to avoid, having the individual programs create their own systems for how you generate an electronic record accurately.

If everybody has to come up with their own validation scheme, then you've got a whole set of programs going this is the right way to validate, this is the right way to validate,

this is the right way to validate, but everybody has to follow CROMERRR to maintain. Just something to point out.

Barbara Foy: My name is Barbara Foy, I'm from Monsanto Company. I wanted to make a comment about the first couple of points up on the screen about the various criteria and their impact on business. While I think there are issues around most of the criteria, by far and away one of the most troubling ones for us in the way we do business is number nine, the archival issue. Archiving these records we would see as a major, major change in the way we do business, a major expense for the way we do business. I just want to make a comment about our 59 current practice, which is paper intensive at this point.

So just to echo some of the comments that have been made just before mine, I'd like to reinforce and go on the record as agreeing with those comments, with the hurdles that the archiving portion of the CROMERRR requirements would cause for a business like ours. Particularly the requirement that requires these records to be preserved with their context, meta data, in the exact electronic form that they were created for years and years and years into the future would present a huge problem and a huge expense.

John Chellen: I'm John Chellen from HRI. I didn't get the gentleman's name sitting at the table up here, but I thought he put his finger on one of the key aspects of this issue. I think it's especially important because it clearly appears that there's a consensus that EPA is certainly overreaching, perhaps inadvertently so, in trying to freeze an incredible amount of data that's upstream of what's the most critical information and clearly downstream of where it all begins.

It seems that we should perhaps separate this into two subsidiary questions. The first is, the most important transaction that occurs, the most important record, is the one that's delivered to EPA. How is that legitimized, how do we verify that the person who sent it is the person who said they 60 are, and is it accurate. Once EPA has received a record of that nature, EPA has it. It seems that we can shift the burden of retention of that record to EPA. Through the legal principle of estoppel, that if it is made public, if that transaction is turned around to the original respondent, the respondent can be put in the position of either agreeing or disagreeing that this is the transaction that occurred. End of discussion at that point, if there is a certain time period for them to agree. I submitted this, it is accurate, and after a period of time they are given no further opportunity to question that transaction.

Nobody except EPA needs to maintain that record any further, except in the following circumstance, which I think this other gentleman pointed out. Was this reflective of the primary business activity and who was responsible for the generation of that record, accurately or not? It seems that we do not need to keep every single intermediate transaction or intermediate record that is used to create that final record,

but we need to maintain the original source data. We need to maintain an accurate statement of the process by which that transaction and that record was created.

If we can get back to the original source data, if we can get back to inventory information and the like, with a paper document if you need it or a paper description of how the final 61 transaction was generated, that satisfies all of EPA's criteria here. The rest of the criteria for the maintenance, for the long term longevity of all the other electronic records the company maintains is beside the point.

I'll offer that as a suggestion to at least analyze this framework. At least subdivide these into the two questions.

One, validity of the final transaction submitted to EPA and being able to safeguard that through estoppel, and the second,

how do we maintain an adequate audit mechanism, whether it's automated or not, to verify the creation of that final electronic transaction. Thank you.

Howard Krueger: I just wanted to briefly input on the concept of EPA's allowing each program office to decide whether they want to opt into CROMERRR or opt out. The caution that I'd like to put forth is that a given point of data or electronic capture of information does not necessarily go to only one program office. So it would be an absolute horror story if one program office took one position and data that would be reported to that given program office was also needed for a compliance record in another program office, which took a direct opposite point of view regarding CROMERRR. That is advanced water torture and certainly nobody wants that.

Mark Duvall: The purpose of today's meeting is to come up with good ideas to help EPA achieve what it needs to achieve. 62 One of the difficulties that we're having is that what's in the Federal Register is so broad. It applies to all EPA programs,

all EPA records, one size fits all. Obviously, there are many areas where the CROMERRR requirements don't fit well.

It would be very helpful for us to help you if we had a better sense of what you need to accomplish. Following up on what Mark Greenwood suggested, there are at least two different things that you're trying to accomplish it strikes me. The first thing that you're trying to accomplish is under the Government Paperwork Elimination Act to fulfill the obligation to make electronic record keeping an option, to remove obstacles. There are certain things that EPA has to do that the rest of us don't have to do in order to achieve that.

Since most EPA record keeping requirements are media neutral or at least have no obvious reason why records could not be kept electronically, what EPA needs to do is to draft a provision,

which addresses the very limited number of circumstances where existing record keeping requirements do have an impediment.

Primarily, they would be ones which have wording that talks about paper or that involve a handwritten signature.

I would suggest that this could be handled through two mechanisms. First, to have a general statement in Part Three that says wherever any record requirement in 40 CFR refers to paper, it is hereby deemed to also allow electronic record 63 keeping. Secondly, by having an electronic signatures piece,

which is in the proposal, that says essentially whenever a 40 CFR requirement talks about a handwritten signature, that can be satisfied by an electronic signature if the following twelve things happen. I would suggest that those are both actions that EPA can do independent of what industry has in the way of its systems or doesn't have in the way of its systems.

The second goal that EPA has, which is quite apart and distinct from the goals of the Government Paperwork Elimination Act, is prevention of fraud in electronic records. There are many kinds of electronic records, many different circumstances under which electronic records are kept, and any particular kind of anti fraud provisions that would work well perhaps in one context might well not work well in another context, and certainly seem not to be appropriate for application across the board.

It would be very helpful if EPA could put into the record an explanation of where it perceives the fraud problems to be occurring. If we've established so far that electronic recordkeeping is commonplace today and has been for a number of years, then presumably EPA has gathered experience with fraud in electronic record keeping through enforcement activity.

Certainly we are aware that there have been fraud cases brought. My understanding is that to the extent EPA is aware 64 of fraud in connection with record keeping, it is primarily in the laboratory context, particularly environmental analytical laboratories. In contrast to that, I'm not aware that there's been fraud in connection with electronic record keeping in areas such as discharge monitoring, air emissions monitoring,

[ Toxic Release Inventory] reporting, etc.

If the need for anti fraud provisions can be identified as being most applicable to a particular program area or a particular context, then it may well be that you can or we can suggest mechanisms that address that need. But in the absence of a context, when we're stuck with a   I won't say one size fits all, but when we're stuck with all record keeping requirements under 40 CFR, we can't even count them, much less address each different circumstance.

So it strikes me that the agency can help everybody reach a solution to determine what mechanisms are appropriate to deter fraud, to detect fraud in electronic record keeping by identifying where the problems are occurring and what kinds of deficiencies have been identified. For example, if laboratory fraud is occurring, is it because of electronic records that are being manipulated electronically or is it because samples have been tampered with so that the subsequent electronic records that are created are faithful representations of electronic analysis of tampered samples? If the latter, then 65 electronic record keeping anti fraud provisions would be irrelevant to addressing that kind of fraud. In fact, my understanding is that certainly the bulk of such fraud as is found in the laboratory context has to do with manual operations, such as preparation of samples, rather than with someone going into a computer file and changing numbers. It might exist in theory, it might happen occasionally in practice, but if the bulk of the problem is manual then CROMERRR type anti fraud provisions would not be appropriate.

Until we know what the context is, we can't give you good suggestions on how to design a CROMERRR program.

Kathy Barrowclough: This is just specifically to your points under the criteria for electronic record retention systems. Number two, which says " maintain electronic records without alteration for required retention period," seems to totally contradict number six, which says that you can have an audit trail because that indicates that you're going to have changes to these electronic records. I just quite frankly don't understand why you'd have a requirement that says don't change this record, and then you say but have an audit trail whenever you change it.

Pat McConnell: Just offer up as a suggestion, the criteria for the e record retention systems seems to have been written or built upon the current paper record systems. One 66 suggestion would be that allow each program office to set a different retention period for electronic records versus what is currently in practice today for paper records. Based on what the gentleman from the electronic notebooks said that the system you buy tomorrow was obsolete yesterday, would allow us to better manage that. The audits on the actual original electronic records can only go back X amount of time.

Austin Perez: I guess I've been thinking as people have been speaking about an alternative. I guess I want to lay out the alternative and the reasoning behind it. I know I'm skipping ahead a little bit, please bear with me. I guess I'd like to get your initial reactions to this option.

Suppose for a moment that there are program offices today,

prior to CROMERRR, that are currently allowing electronic record keeping. So that means that they must have taken the legal steps necessary in order to make that legal. Whatever that may be, whether that's guidance, law, however they're doing it.

I guess the question is, or at least one option would be in these circumstances where these folks have already turned on the electronic record keeping, why would they have to do anything at all under CROMERRR? I suppose that there would be a situation or there could be situations where there are, I guess, program offices where electronic record keeping is not 67 allowed legally, there is a legal barrier to it. In those instances where there's a legal barrier, those program offices could opt into CROMERRR in order to address that legal barrier.

But in those instances where they don't see or they have taken steps in order to climb that barrier, I guess one alternative would be, why do they have to do anything at all? When CROMERRR goes into place tomorrow, why can't they just remain silent and why couldn't the current program that they have in place remain in effect? I want to lay out that alternative and I guess I'd like to get your initial reactions.

Robin Roberts: If possible, as you pointed out, there is a point on the agenda dedicated specifically to alternatives to e records. If the panelists would care to respond to the question now that's great, but I would just like to have that question out there for everyone's consideration and we can come back to it, perhaps as the lead question when we get to that section on the agenda. Because we are at lunch and I never like to get between people and their lunch.

[ Lunch break]

Robin Roberts: ... your agendas, you'll see that the discussion we began before lunch we were just going to continue after lunch. Before we do that, David just had a few words he wanted to say in response to some of the comments he heard earlier. 68 David Schwarz: Mark Duvall asked me if we could give some examples of fraud related concerns that might provide a context. I don't want to do this in a sense that would be interpreted as at all global. We don't have our enforcement people here today and I don't want to speak on their behalf.

But I thought I'd give you an example anyway which I think is pretty straightforward and might sort of help frame the problem, or at least a problem in some cases. It's actually an example from the world of paper, but I think that when I give it to you you'll see what we're looking for as an electronic counterpart.

There have, as I understand it, been a number of fraud cases involved with laboratories that have been prosecuted over the last ten years or so. In conjunction with those, in at least once case, maybe more, as a part of discovery the enforcement people were very glad to get their hands on the lab notes that recorded original observations. One of the things that was really interesting to them is that in at least one case the lab notes had whiteout and then writ[ ing] over on top of [ the] whiteout for some of the values noted. Of course,

that raised a red flag. It doesn't automatically mean that this is fraud, but it certainly raised the question of clearly these were changed. That helped them with the investigation.

If you think about the transfer of that to the electronic 69 environment, I think one of the problems, or one of the goals that is sometimes set for us is that we would like to make sure that the electronic system provides something that corresponds to the whiteout, that provides a corresponding forensic   we're not going to have whiteout clearly, but on paper it is very often, not always but sometimes or often, possible to determine that things have been changed. There's all sorts of rules about how you keep a lab notebook and you can sometimes tell if those have been violated.

So again, I think that one of the things we're looking for, and I don't know whether we've gotten there or not, but one of the things that we're looking for is a way to give us the corresponding information in the electronic environment.

We'd like to see the electronic whiteout or something like that that would give us a forensic where we need it, where in fact there is a question of fraud that has to be pursued. So that's one example, it's clearly not the only kind of case, it's not the only kind of concern. But I throw that out for your consideration and if people have ideas about ways that we could solve that problem we'd be very interested in hearing that.

Mark Duvall: The laboratory example is also the example that comes to my mind. I think there are a number of tools already in place that do address that. They're mainly in the good laboratory practice requirements. Obviously not all lab 70 studies are done under [ Good Laboratory Practices], but the point is that EPA in addressing laboratory fraud has already addressed it. There are a number of provisions in place to require reliability of records. For example, there is an audit trail requirement in the [ Good Laboratory Practices]

requirements, Section 130( e). There's a requirement that electronic equipment, like other equipment, be calibrated and be appropriate, and the [ Good Laboratory Practices] enforcement people have interpreted that equipment calibration requirement very aggressively to require certain steps to be taken.

So there are a number of ways to assure quality, to assure reliability in the laboratory context. Another example, not limited to the [ Good Laboratory Practices] context, is EPA methods, where typically EPA methods have a number of steps in there that are designed specifically to address reliability of the results.

So to the extent that laboratories are the main issue,

it's helpful to deal with it in those terms, because there are a number of laboratory specific approaches which have been implemented and conceivably could additionally be implemented that would be appropriate for laboratories but which might not be appropriate for other contexts. One example of a point that EPA has proposed is an amendment to the good laboratory practice regulations that would talk about the need for 71 security provisions that would be applicable to electronic as well as paper records.

It's interesting that in that proposed rule, which I understand is sort of hanging fire because CROMERRR came along,

in that proposed rule EPA considered it to be sufficient to have a provision that said security provisions, without detailing what those security provisions might be. They didn't say audit trail and preservation of records and this and that,

they made it a performance standard to require   and again,

this is just a proposed rule   but to do what was appropriate under the circumstances.

That might be an approach that EPA could consider, a performance standard that says under these circumstances do what is appropriate and we can give you some suggestions. But not require specific things in all program areas which might well not be appropriate.

Mark Greenwood: On the fraud issue, I think it's useful to, since we're kind of on this topic, to ask you to also think more broadly about the set of factors that you should think about that go beyond the one that you were just describing.

The electronic audit trail concept and how that fits in with a whole set of factors that frankly push back against the likelihood of fraud. In other words, I think there's some other things to think about. 72 Mark was alluding to the fact that if you're going to commit fraud in the entry of data, audit trails don't help you.

But there are several other factors as well. In some ways,

what we have today as we look towards moving with electronic sensors and monitors that are connected directly to the electronic data systems, frankly you are reducing the probability that humans are going to get in there and change the data. I would submit that the trend we're on with electronic reporting and record keeping is anti fraud in many ways.

Another factor to consider is, for many of the records we're talking about here, they are also business records. So for example, a [ Toxic Substance Control Act] requirement may need to know the production data you have. There are all number of reasons why you're not going to go falsify your production information. That's fairly useful business information. That pushes far against anything you do for an EPA requirement.

Then I think institutionally, [ inaudible] recognize that falsification of information, depending on the context, can be a criminal act. I would not minimize to any great degree how significant that is in the minds of an employee of a company.

The electronic media reinforces that in the following sense.

Electronic systems tend to facilitate the sharing of data, so 73 if a bunch of people have access to data and you want to falsify something, you suddenly have to sort of muster a conspiracy of people to try to make sure that that data is changed and it stays that way to actually make this come off.

That's highly improbable in the world in which we work today. So I think there is a set of these factors that need to be weighed and looked at as you look at the overall question of fraud.

Bruce Adler: I want to just add to what the two Marks have just said. That is, if you step back a little bit and think, let's use air monitoring as a particular example. If you've got an air monitor with a readout and somebody, a worker, an employee, goes over and takes the reading off of that air monitor, writes it down, and you compare that to a continuous emissions monitor which feeds it directly into a tracking system, the latter program of the electronic recordkeeping is much less likely to be susceptible to fraud than the transcribing. If you're looking at decreasing the likelihood of fraud, you do that by encouraging electronic record keeping.

You don't have to get into the audit trail picture. It's not relevant.

If your objective is to reduce the likelihood of fraud,

using and making it easy to use electronic record keeping accomplishes that objective. But if you're trying to add more 74 onto it by let's say making fraud impossible, then you set an unreasonable goal for yourselves and you're going to create an unworkable system. So I really encourage you to step back and say, is this system, is an electronic system less susceptible to fraud than a handwritten system, a paper record system. If the answer is yes, then you've achieved your objective.

Carolyn Greenwood: Carolyn Greenwood, I'm from Environmental Systems Corporation. No relation to Mark Greenwood that I know of. We are a data systems vendor, which sounds like a dirty word in this room, if I remember earlier.

We do not require upgrades on purpose. But my real point, what I wanted to say is, we do mostly air monitoring applications,

almost exclusively. We have a lot of utilities that are our customers and a number of state agencies. Most state air pollution agencies use our software.

I just want to say, adding an audit trail can be quite expensive. It's not a simple thing for us to do. We have done that to our programs, most of our programs have them. But I can't speak for the other media, the other vendors. I don't know if they would have them. I'm guessing a number of people would need to have their software changed to add an audit trail and that's not a trivial thing. So keep that in mind as you're considering that.

Robin Roberts: Any more questions on general criteria of 75 the rule and technical aspects of implementing it, problems?

Seeing no hands raised, one last hand and then we'll move on.

Unidentified Male Speaker: I'll just make a comment to follow up what this young lady said. One of the things that has been pointed out to me by the [ information technology]

people at my company is that yes, we buy standard packaged software from vendors. But regrettably, we don't implement it in a standard way. We customize everything. One of the things I've learned from talking with many of my colleagues is, I won't say everyone, but the large majority of companies customize these standard packages. So that even if you create a solution to the off the shelf product that you buy, you still have to generate hundreds of different implementation scenarios for that one package that you buy.

Charles Reese: One thing we haven't touched on today is how to deal with electronic records in, say, a sponsor contract facility relationship. This creates a very difficult problem for us, if a sponsor company were to go and hire a contract facility and that facility has electronic record keeping systems. Those systems may have some sort of compatibility or no compatibility whatsoever with the sponsor systems.

Now we purchase work, the work is done, completed. At that point, how do we address maintaining electronic records that we may have no way to read or no way to handle because 76 they were generated on a completely alien system to us? Is it going to be the contract facility's responsibility to maintain that electronic record for the life? Or are they going to charge us to maintain that system? Are they going to transfer it to us like they do the paper records now and say, you paid us your money, we did the work, we're done, now it's your responsibility. If that's the case, we could end up with a giant set of files that we literally can do nothing with but maybe maintain.

So what do we do in those situations? How we handle this contract situation is going to be a very big question for any kind of managing electronic records. This relationship goes on with any company out there who outsources any kind of work.

Those are big general criteria to think about.

Kathy Barrowclough: While we've talked about this and sort of touched on it with several of the different comments made, I don't think we've really identified the considerable issue with the idea of legacy systems. It was sort of touched on by the vendor there in saying how difficult it is to add an audit trail, but in essence once CROMERRR is implemented companies would be obligated to review all of their existing systems to see whether or not they meet the CROMERRR criteria,

in order to ensure that they do meet those criteria.

The cost of doing that is really great. First you've got 77 to inventory all of your systems, look at each of those systems and see whether or not it has audit trail capability or function, whether it has all of these security features that the nine points raise in the record keeping part. Then you have to get a plan in place for what you are going to do with that, so that when the enforcement arm does come around you can say what's happening. There's a considerable cost and resource drain in order to do that for all of those legacy systems.

Robin Roberts: Any last questions? Thank you for your comments on that. Before we move on to the alternative approaches, to e records standards, David had a word he wanted to say. Then also the audience, Ms. Roberts here would have something to say after David's comments.

David Schwarz: Just as we begin to talk about alternatives to the current proposal, I just think it's important to remind ourselves that the rule making process is an agency wide process. The decision as to what we actually come up with as a final rule is not just up to the people who are seated here.

So I know in some cases it may be disappointing or frustrating that you give us this great alternatives, we don't just nod our heads in unison and say oh yes, we'll do that.

But we can't say that, because we really   what we can do as appropriate is we can give you feedback in terms of what we 78 might think of it individually in some cases. But the truth is, for all the ideas that we hear today, we'll be willing to take them back to our colleagues at the agency, to the workgroup, and consider them together.

So I just don't want people to feel that because we're not going to give you, say yea or nay, as you make suggestions,

we're certainly going to consider them, and we're very grateful to have your thoughts. You will see us respond to them but the response may not become apparent until the final rule is published or until some notice is published that indicates an action. So I just want people to be clear about that.

Robin Roberts: We had a question before we broke that anticipated this discussion. That gentleman has left the room but Ms. Roberts is going to tell us about it.

Kathleen Roberts: Remind me to thank Austin for posing this question and then leaving. As I recall, the question was,

if there were some programs that had already legally implemented the ability for companies to use electronic recordkeeping I guess essentially would those be grandfathered in under CROMERRR. Would CROMERRR have to apply to those programs or could they forever opt out of CROMERRR? If I restated the question incorrectly, certainly someone let Robin know.

Jamie Conrad: Jamie Conrad with the American Chemistry Council. He talked a little bit about it. What he was 79 suggesting was since it appears as though in virtually   it seems to be hard for any of us to come up with an example where existing EPA regulations would seem to prevent electronic record keeping, then why not just state that all current forms of electronic record keeping are okay. And if there are any that anybody's aware of out there, any instances where people are keeping paper records and wish they could go electronically, those people could opt into CROMERRR. But it would only exist as an option for those people that wanted to pursue it, and that otherwise electronic record keeping could be sort of authorized kind of by fiat, the way it is now.

Unidentified Male Speaker: The response is we could do that. I think that's an option that we're prepared to consider.

Howard Krueger: A caution on the issue of grandfathering is if you grandfather everything that you're doing now and say we're only going to do things in the future, based on the profile of burgeoning regulation in the past ten years and even more in the last five years, it certainly isn't going down.

That will still place a huge burden for all new, yet to be defined, regulations. So that's one caution.

But even more importantly I think is, if you were to grandfather existing systems, then what about eighteen months later when there is an upgrade to an existing system, so you 80 now have a new system. Suddenly, your current way of doing records, which was nicely grandfathered, no longer maintains that shield and protection because of the new system that came in.

As we all know, technology, there's some rule that every eighteen months everything is changed. So the grandfathering is only good for eighteen months, and then suddenly it's back to ground zero again. So I am very hesitant about thinking   let's say I don't understand how grandfathering would work. If there is some creative solution that would be wonderful, but I just don't understand how that could work.

Mark Duvall: Thinking about alternatives to CROMERRR as it's structured now, it strikes me that   [ End of Tape 2, Side A; Side B begins]

 need to be addressed, because timing is very important here, as we decide what needs to be addressed now, what can be addressed later. The one pressing time driven provision is that of the Government Paperwork Elimination Act. That requires EPA to make electronic record keeping available as an option by October 2003. That piece of rule making   Unidentified Speaker: Reporting.

Mark Duvall: Both of them. Both options, both reporting and signatures and record keeping need to be made available by October 2003 according to the legislation. So what EPA needs 81 to do by that time is to the extent that there are any obstacles to electronic record keeping, those need to be removed through rule making. To me, the only obstacles that could be available would be those that call for a handwritten signature. That can be addressed through a fairly straightforward prophylactic electronic record keeping provision. That's the only time driven piece.

The bulk of what's in the record keeping provisions in CROMERRR are not addressed to that aspect, but rather are addressed to the anti fraud concerns. Those are appropriate public policy concerns that need to be addressed in an appropriate forum. Rule making is an appropriate forum. But keep in mind that the timing for those provisions is quite different from the timing for the [ Government Paperwork Elimination Act] driven provisions.

The current CROMERRR provisions obviously are causing a lot of consternation. They are probably not the right approach for addressing the fraud provisions, for a couple of reasons.

The main reason being that they're not addressed to the particular concerns, the particular problems with fraud.

[ Office of Management and Budget], in issuing guidance to agencies under the [ Government Paperwork Elimination Act],

urged agencies to conduct a risk assessment, to find out where the concerns are with fraud, address the high, medium and low 82 areas, and address the security provisions according to the results of that risk assessment. Most agencies have done that and have reported to [ Office of Management and Budget] where their biggest concerns are. A lot of times those have had to do with reporting, as opposed to record keeping, but the same requirement applies to record keeping.

It strikes me that what would be appropriate for EPA to do would be to do a risk assessment, find out the areas where there is a high concern with fraud in electronic recordkeeping and devise proposed anti fraud provisions that would be appropriate for those contexts, one or more. Industry would be glad to participate in a focused discussion as to what would be appropriate for particular contexts. From what we heard this morning, quite possibly the laboratory context might be one such area. In fact, anti fraud provisions have been a main topic of discussion in connection with the [ Good Laboratory Practices] regulations ever since their inception, because much of what the [ Good Laboratory Practices regulations] are for is prevention of fraud.

The timing on this focused anti fraud discussion   there is no particular time constraint to that. Accordingly, it's appropriate for EPA to do the ground work of the risk assessment that [ Office of Management and Budget] called for to identify the high priority areas and then to contemplate 83 particular, appropriate, media specific, context specific,

proposed controls that could then be debated in an appropriate manner. But that would mean that the record keeping provisions of CROMERRR would need to be decoupled from the electronic signatures and the electronic record keeping provisions.

Otherwise, that anti fraud discussion will slow down the promulgation of the signatures and reporting provisions, which have the time deadline.

So my suggestion as an alternative to what has been proposed in the Federal Register is to decouple them, have EPA do the risk assessment, draft appropriate provisions and then repropose.

Robin Roberts: Mark has broached a subject that we had discussed as something that should be on the agenda. This was the particular discussion where we wanted to hear your thoughts about this notion of decoupling Subpart C from the rest of the rule.

Henry Bartholomew: I think to follow on the comments that were just offered and Mark Greenwood's comments earlier about the hierarchy, a unifying theme for how EPA might approach each of these categories, the issue of making electronic recordkeeping and reporting generally available   a separate issue,

is there a problem with reliability and being able to track the reliability and fraud issues. Third, the archiving and long 84 term retention issue. I agree to break these up if these are three separate themes. A unifying theme would be, is anything broken.

Let's start with the electronic record keeping and reporting. You're hearing from folks in this room that the vast majority of large businesses and industries in this country are using electronic record keeping and to some extent reporting to comply with EPA monitoring and reporting requirements. So that suggests to me that for the primary program areas the EPA is involved in   air, water, that I know of for sure, and others, solid waste   there may not be a huge problem in companies being able to do it. Fact is, they're doing it. There may yet be, on the other hand, some areas for improvement. It may be that EPA can do some things to make reporting more easily available electronically than is currently the case.

My suggestion would be, if you want to step back and take a fresh look at this in light of all the negative feedback you're getting on what's been proposed, put out a notice of inquiry on the electronic record keeping and reporting issue and say, are there areas where you, industry, are having problems being able to do this under EPA's current regulations,

the statutes and our guidelines and policies. See what feedback you get. 85 The answer may be, not very many, and it goes to the point just raised. What you need to do by October 2003, presumably,

is help to address those specific issues. So focus on that.

You may find that there's not a lot that needs fixing and you may not need this sort of global approach to fix those sorts of problems. So that would be a recommendation.

Then if you want to step to the fraud issue, same question. There I think the experience of your enforcement staff is pertinent. The question again is, are you finding things are broken.

I liked the suggestion that came up sort of tangentially earlier, of require people to document the system that they've got in use from 1995 to 1999 before they adopt a new system and what the [ inaudible] of reliability of that system are. Keep that so that if a question later arises within an enforcement or audit timeframe they have that as the [ inaudible] of reliability as to the information that was provided to EPA.

Don't necessarily require them to track through an auditable signature hand off approach every data element that comes out of an automatic monitoring system and is handled by multiple computers and software processes and so forth, ad infinitum,

with the costs that you're hearing about. Make them document what the system is and provide that as the [ inaudible] of reliability. So a couple of thoughts. 86 Maria Angelo: DuPont supports the proposal to decouple the reporting and e signature from the record keeping, and very strongly supports the concept of the risk evaluation assessment and setting priorities around the anti fraud. However, that's not to say that we support the proposed rule with respect to the reporting and e signatures. We have some specific concerns around why the proposal goes farther, in our mind, than the esign legislation and the reporting rules itself with respect to registration for submitting reports electronically, the concept of validation and the number of registrants per facility,

delegation of authority, those sorts of things. So I think that part of the rule, while it may be able to be decoupled, I think still has some opportunities to make it a little bit more workable.

Jim Scialabba: In line with some of the comments that have come out about the decoupling, as regards the recordkeeping something that the EPA has done in other programmatic areas to improve the workability of regulations has been to move more to performance standards and away from prescription.

I believe that that's one of the problems that we're all tripping over in our review of the record keeping requirements here is that it's too prescriptive. One thing about prescription, and particularly as relates to information technologies, is too much prescription inhibits innovation. I 87 think as the regulations are currently written, that it would inhibit the kind of innovation you all would be looking for that would improve reliability, and for us in the regulated community would find opportunities to reduce the cost and the burden, yet improve our compliance profile.

With all that said, a for instance of what the EPA has done that we have found beneficial is encouraging companies to implement environmental management systems, because it's the linkage between all of the activities in organizations that aren't put in place or aren't efficient that have been found to be inhibitive to improved compliance.

So I believe the record keeping requirement, if it would step back from   be less prescriptive and more encouraging,

performance standard based around a record keeping management system, that it would be more palatable. Industries or companies would find ways to comply with a performance standard that should satisfy a lot of the record keeping requirements that the EPA rightly should require for validation, for information that's turned over to the agency.

Frank Miller: In the spirit of brainstorming, again just share some ideas about alternative approaches. Some other things that maybe you could focus on in the spirit of e records is sort of around transaction standards, that area, making it easier to conduct the business of reporting. Focus on the 88 standardization of the various government or agency systems that we have to report to, to again help minimize the effort to do reporting. It's been said a couple times already, around either performance oriented standards or guidance or perhaps even phased in standards from sort of what's minimal or what's reasonably achievable in today's environment with an eye towards maximum or highly disciplined approach to this, giving software vendors or our staffs time to figure out innovative ways to close those gaps.

I've heard a lot of good things today in terms of record creation, analysis, data capture. It's very prevalent and it's a smart way to do things. Is there anything that we can do in terms of moving forward in some sort of partnership way, beyond just sort of this commenting approach to the rule? Is there any better way for us to collaborate together on achieving this?

I guess lastly, perhaps we could have an alternative goal,

or an additional goal, and maybe that goal could be drive toward minimizing the effort to report compliance and to receive what we're reporting, such that we both and we all benefit from that, so that we can focus more on the source reduction, the sustainability and so on. If we can take the cost and the effort down there, that can serve a greater purpose. So in the spirit of brainstorming, those are some 89 ideas.

Mike Penders: Mike Penders, Environmental Protection International. The more I consider this, and as you know we've considered this together for some time, the more I really come to the opinion that the record keeping has to be decoupled from the electronic reporting to facilitate this. Otherwise, you set up a dichotomy, just focused on ways to minimize fraud,

where all the potential for fraud currently exists with the electronic record keeping that occurs now and could continue as long as someone prints it out and submits it to the agency.

But you're setting up conditions for those who would electronically report that do not apply to those who submit on paper now. So first, it's not effective to address fraud.

Secondly, it presents obstacles to electronic reporting,

which provides a whole range of other benefits to the enforcement and compliance function and may be even of greater benefit in detecting fraud in the first instance by keeping the obstacles low to facilitating more electronic reporting, which allows a timeframe of bringing information together from other sources that allows the government to detect fraud in the first place.

So I think it's really fundamentally unfair to require companies as a condition of electronic reporting and against the thrust of a lot of the paperwork elimination laws and 90 policies and the e commerce law signed by President Clinton, to require a standard that's not now required under law or regulation of those who rely on electronic reporting, just by virtue of the fact that a company chooses to avail itself of an electronic reporting option. And then address the considered opportunities for fraud and record keeping requirements that may combat that, program by program, where those problems with fraud have manifested themselves, such as in the laboratory context.

But taking part of the criminal investigations into the laboratory fraud, such as some of the cases have been publicized, it would have made no difference to that investigation if that had been electronically reported. In fact, it would have provided greater opportunities for the government to investigate if it had been electronically reported than having to go through all the paper submissions and then compare that back to the electronic record keeping that was in place and trying to reconcile that.

So in considering this, I really think that it makes a lot of sense to decouple and consider the record keeping requirements in part of other programs.

Kathleen Roberts: On the basis of what industry understands of EPA's concerns related specifically to fraud and archiving and the rule as proposed, [ American Chemistry 91 Council] believes there are no simple modifications to the proposal or the criteria. We don't see any quick fixes that can go in. So we also support the suggestion of decoupling the record keeping from the rest of the rule and moving forward.

Notwithstanding what might be needed in order to meet the deadline for the [ Government Paperwork Eliminatoin Act]

requirements.

Kathy Barrowclough: What I'd like to do is, you're hearing a lot of let's decouple the record keeping from the reporting. I'd like to go even beyond that, in that our understanding is that Office of Environmental Information is not the enforcement arm, it's the different programs. Even after, if indeed the decoupling occurs, we believe that it would be important for EPA to set up workgroups of regulated industry as well as internal program people from the enforcement arm, in order to work through what some of those issues are and come up with an acceptable record keeping rule.

Barbara Foy: I just wanted to also support the notion that's been expressed of decoupling the record keeping portion of the rule to allow for additional consideration of all of the various issues that have been raised today. I think that some of the strongest reasons for that include the fact that has been pointed out that all records don't seem to be created equal, the high costs that have been estimated, to be 92 associated with complying with CROMERRR, and the lack of technology available today to meet some of the requirements that are proposed by the rule. I've also heard a number of people express support for an approach that considers maybe a tiered type of approach to record keeping, dividing recordkeeping into different categories and maybe setting different criteria depending on the nature of those records, and would also want to support some further investigation of that kind of an approach.

Mark Greenwood: Obviously you're hearing some fairly consistent general advice here from I think everybody, which I certainly would support. The one thing though, following on a comment that was just recently made, as you look at some of these requirements that you'd like to improve for the future,

let's talk about this archiving notion as an example. It is important for you, [ Office of Environmental Information], not to try to do that yourself. I'm sure you don't want to. But you have program offices who have set these record keeping time periods. These have for the most part never really been carefully reexamined after twenty, twenty five years sometimes.

A very useful exercise is to be going through those individual record keeping requirements and the timeframes and say, why are we making people keep these records so long, and really examine the underlying policy reasons for doing that and 93 try to decide whether it makes any sense to do today. So I would urge you, as you look at at least that piece of it, to really bring in the other program offices and have more policy discussion on those questions.

Bill Barta: Bill Barta, FMC Corporation. I want to second the proposals to separate record keeping from reporting.

Obviously, there are many complex issues to be discussed that are going to take some time to consider carefully. But I want to also suggest that we ought not to ignore the reporting side.

There are some significant problems, as I see it, on that side.

I would hope there would be some way or forum or public meeting to address those as well.

Howard Krueger: Likewise I support the decoupling. I was going to make a specific suggestion that was just made over here about having a meeting such as this focused on the reporting and electronic signature side. I think that some ideas might come out of that to provide the improvements that would help the other part of the proposal to survive and to attain the deadline targets that we all are aware of, October of ' 03. So again, I support decoupling and to create a datagathering and corrections type session on those other two parts.