current, publicly available information on the risk management plan
national database is insufficient for informing communities about RMP-
regulated facilities.
     Facility Registry Service (FRS) and Envirofacts.\309\
EPA's FRS provides information about facilities regulated by a large
number of EPA regulations under various statutes. Currently, the only
information provided in the FRS for RMP-regulated facilities is the EPA
Facility ID, EPA's unique identifier for RMP-regulated facilities.
Because Envirofacts provides a multi-system search of facilities,
including FRS, RMP EPA Facility IDs are also available in Envirofacts.
Currently, neither public-facing version of the databases provides
additional information or allows users to export information on more
than one RMP facility.
---------------------------------------------------------------------------

    \309\ Facility Registry Service, https://www.epa.gov/frs.
Envirofacts, https://enviro.epa.gov/.
---------------------------------------------------------------------------

     FOIA requests. EPA has processed FOIA requests for non-OCA
data 242 times since 2015, an average of 35 times a year. Because the
database is provided in Microsoft Access format and requires some
technical background to examine results, most requestors tend not to be
individuals or nonprofit environmental groups, but rather other
government entities (both Federal and State), as well as consulting
groups and government contractors.
     Federal reading rooms. 40 CFR part 1400 requires the
Federal Government to allow any member of the public to obtain access
to OCA information for up to 10 facilities per calendar month located
anywhere in the country, without geographical restrictions, as well as
any stationary sources in the jurisdiction of the LEPC where the person
lives or works and for any other stationary source that has a
vulnerable zone that extends into that LEPC's jurisdiction. Although
EPA does not have plans to release protected OCA information on the
internet, EPA hopes that making non-OCA risk management plan data
publicly available will reduce the need for the public to access risk
management plan data only through Federal reading rooms.
     Other information already publicly available. EPA notes
that it appears information from the risk management plan database,
less OCA sections, has been publicly available on the internet for over
20 years.\310\ EPA is aware of other sources of information online for
risk management plan data, however, these data are often outdated. The
dataset provides information on location, amount of chemical stored,
emergency response capabilities (i.e., responding versus non-responding
facility status), contact information, executive summary, and 5-year
accident history.
---------------------------------------------------------------------------

    \310\ The Right-to-Know Network, ``Risk Management Plans
(RMP),'' last modified March 14, 2019, https://rtk.rjifuture.org/rmp/.
---------------------------------------------------------------------------

c. Other EPA Facility Hazardous Substance Registries
    EPA makes information available for several other Federal hazardous
substances programs, such as the Toxics Release Inventory \311\ under
EPCRA and Chemical Data Reporting (CDR) \312\ under the Toxic
Substances Control Act, both of which have readily downloadable
information (in Microsoft Excel format) \313\ on facility quantity and
location for facilities with regulated, threshold quantities of listed
hazardous substances. EPA likewise seeks to make its non-OCA risk
management plan information available in a readily accessible manner,
akin to these two programs, and will coordinate with these two long-
standing programs to consider relevant data quality and security
concerns.
---------------------------------------------------------------------------

    \311\ EPA, ``Toxics Release Inventory (TRI) Program,'' last
modified January 20, 2022, https://www.epa.gov/toxics-release-inventory-tri-program.
    \312\ EPA, ``Chemical Data Reporting Under the Toxic Substances
Control Act,'' last modified August 25, 2021, https://www.epa.gov/chemical-data-reporting.
    \313\ EPA, ``Access CDR Data,'' last modified November 9, 2021,
https://www.epa.gov/chemical-data-reporting/access-cdr-data#2020.
---------------------------------------------------------------------------

d. Balancing Security Risks and Community Right-To-Know
    EPA maintains that public disclosure of risk management plan
information would likely lead to a reduction in the number and severity
of accidents.\314\ Although EPA does intend to make its risk management
plan data publicly available, it seeks comment on an approach that
balances community

right-to-know and security concerns that arise by making such data
publicly available in an easily accessible, consolidated location. EPA
requests public comment on which specific information would be of most
benefit and most concern.
---------------------------------------------------------------------------

    \314\ EPA, Assessment of the Incentives Created by Public
Disclosure of Off-Site Consequence Analysis Information for
Reduction in Risk of Accidental Releases (April 18, 2000).
---------------------------------------------------------------------------

    EPA has long received comments on the potential security concerns
in releasing risk management plan information. For example, in EPA's
recent 2021 listening sessions, some commenters, including several
industry trade associations, expressed opposition to expanding risk
management plan information availability due to increased risks of
terrorist attacks, cyberattacks, or other intentional acts of
harm.\315\ One industry trade association argued that certain
information about RMP facilities needs to be kept confidential, such as
the information deemed ``Chemical-terrorism Vulnerability Information''
or ``Sensitive Security Information'' under the Department of Homeland
Security (DHS) Chemical Facility Anti-Terrorism Standards (CFATS) and
the Maritime Transportation Security Act, respectively.\316\ However,
these comments did not specifically explain how releasing risk
management plan data would increase particular security risks. EPA
already protects OCA information as required by the CAA and will ensure
that this action does not violate the CAA.
---------------------------------------------------------------------------

    \315\ EPA-HQ-OLEM-2021-0312-0005; 0020, 0031, 0045, 0053, 0071,
0077.
    \316\ EPA-HQ-OLEM-2021-0312-0031.
---------------------------------------------------------------------------

    There exists no publicly available database of intentional acts
upon the chemical process industries in the United States. In a 2021
study, researchers attempted to compile a database of such incidents,
finding documentation of 84 incidents in the chemical and petrochemical
industries.317 318 Root cause data on these incidents, which
are not available, would be needed to determine if availability of
information on the facility contributed to terrorist incidents, which
were second to cybersecurity incidents as the most frequent overall
cause. According to the database, no terrorist event in the process
industries (excluding transportation and pipelines) has occurred in
North America after the 1970s.\319\ However, a lack of incidents may
result from the safeguards currently in place. DHS promulgated CFATS in
accordance with the Homeland Security Appropriations Act of 2007, owing
to insufficient security at industrial facilities. In promulgating
CFATS, DHS did not intend for information created under CAA 112(r) to
constitute ``Chemical-terrorism Vulnerability Information,'' which is
sensitive information pursuant to CFATS requirements (72 FR 17714). EPA
routinely coordinates with DHS as part of the Chemical Facility
Security and Safety Working Group and commits to working with DHS to
find regulatory solutions that balance community right-to-know with
security concerns.
---------------------------------------------------------------------------

    \317\ Valeria Casson Moreno et al., ``Analysis of Physical and
Cyber Security-Related Events in the Chemical and Process
Industry,'' Process Safety and Environmental Protection 116 (2018),
621-31, doi:10.1016/j.psep.2018.03.026.
    \318\ Matteo Iaiani et al., ``Analysis of Events Involving the
Intentional Release of Hazardous Substances from Industrial
Facilities,'' Reliability Engineering & System Safety 212 (2021),
107593, doi:10.1016/j.ress.2021.107593.
    \319\ This is not a complete dataset, because it was developed
based on publicly available information. Available in the
supplemental material of Matteo Iaiani et al., ``Analysis of Events
Involving the Intentional Release of Hazardous Substances from
Industrial Facilities,'' Reliability Engineering & System Safety 212
(2021), 107593, doi:10.1016/j.ress.2021.107593.
---------------------------------------------------------------------------

    Accidental releases occur much more often than intentional events
(about 100 per year using EPA RMP-reportable accidents). Pre-incident
information, such as the locations of facilities and potential
disasters, allows communities to be more prepared for disasters,\320\
which DOJ also recognized in its 2000 risk assessment.\321\ With over
20 years of data now, EPA has based many of the proposed provisions on
prior accident information.
---------------------------------------------------------------------------

    \320\ Holly Carter, John Drury, and Richard Aml[ocirc]t,
``Recommendations for Improving Public Engagement with Pre-incident
Information Materials for Initial Response to a Chemical,
Biological, Radiological or Nuclear (CBRN) Incident: A Systematic
Review,'' International Journal of Disaster Risk Reduction 51
(2020), 101796, doi:10.1016/j.ijdrr.2020.101796.
    \321\ DOJ, Assessment of the Increased Risk of Terrorist or
Other Criminal Activity Associated with Posting Off-Site Consequence
Analysis Information on the internet (2000), https://www.regulations.gov/document/EPA-HQ-OEM-2015-0725-2003, EPA-HQ-OEM-
2015-0725-2003.
---------------------------------------------------------------------------

    EPA acknowledges that the Agency must consider whether some non-OCA
data elements, or combinations of elements, may not be suitable for
public release and should be restricted based on potential security
risks. EPA has been and will continue to work with DHS, DOJ, and other
Federal partners on identifying these risks. EPA is also involving the
public through seeking comment. EPA requests comments on which
elements, or combinations of elements, may pose a security risk if
released to the public. EPA also notes that, while several commenters
offered support in the 2019 reconsideration comment period for
rescinding information availability requirements on the part of the
facility, no commenters provided additional information to support
security concerns.\322\ For each element or combination of elements
identified, EPA requests: (1) Specific comments on why the element or
combination of elements presents a security risk and (2) documentation
or basis for these security claims, such as risk or intelligence
analysis, a prior incident, security threat, or near miss incident.
---------------------------------------------------------------------------

    \322\ EPA-HQ-OEM-2015-0725-1461; 1867, 1904, 1909.
---------------------------------------------------------------------------

D. Other Areas of Technical Clarification

    EPA has provided compliance assistance, conducted inspections, and
undertaken enforcement of the RMP program since 1996. During that time,
the Agency developed guidance documents, model RMPs, and answers to
frequently asked questions to help facilities implement the RMP rule.
Based on experience, EPA has identified various aspects of the RMP rule
that use different terminology for the same requirement, have outdated
definitions, or would be simpler for sources to implement with more
discussion in the text of the regulation. The intent of the proposed
changes to the regulatory text discussed in this section is to simplify
implementation for facilities as well as oversight, thereby improving
chemical safety. The proposed amendments do not change the meaning of
the RMP rule. These points are raised below.
1. Process Safety Information
    RMP regulations require that facilities keep process safety
information up to date. For processes subject to Program 2
requirements, RMP regulatory text explicitly states in 40 CFR 68.48(a)
that ``[t]he owner or operator shall compile and maintain the following
up-to-date safety information related to the regulated substances,
processes, and equipment.'' This is also addressed in 40 CFR 68.48(c),
which states: ``The owner or operator shall update the safety
information if a major change occurs that makes the information
inaccurate.''
    For processes subject to Program 3 requirements, the process safety
information requirements within 40 CFR 68.54 do not explicitly address
updating process safety information. Instead, that subject is addressed
in several other parts of the Program 3 requirements, including the
management of change requirements in 40 CFR 68.75, the pre-startup
review requirements in 40 CFR 68.77, and the requirement to document
that

equipment complies with RAGAGEP in 40 CFR 68.65(d)(2).
    Management of change requirements only apply to processes subject
to Program 3 requirements, because there are no corresponding
requirements for Program 2 processes. The management of change
requirements address changes to process chemicals, technology,
equipment, and procedures, as well as changes to stationary sources
that affect covered processes. Pursuant to 40 CFR 68.75(d), process
safety information is required to be kept up to date ``If a change
covered by this paragraph results in a change in the process safety
information required by Sec.  68.65 of this part, such information
shall be updated accordingly.''
    The pre-startup review requirements in 40 CFR 68.77(a) apply to new
stationary sources and modified stationary sources when the
modification is significant enough to require a change in process
safety information. Pursuant to 40 CFR 68.77(b), the pre-startup safety
review must confirm that construction and equipment meets design
specifications.
    Therefore, in order to make the regulation more consistent
throughout, EPA is proposing to clarify that the requirement to keep
process safety information up to date also explicitly applies to
Program 3 processes. 40 CFR 68.65 states that ``[t]he owner or operator
shall complete a compilation of written process safety information
before conducting any process hazard analysis required by the rule.''
Refining the language of 40 CFR 68.65 to reflect existing requirements
would clarify that such process safety information is required to be up
to date for Program 3 processes--just as for Program 2 processes--
without the need for evaluating compliance with management of change,
conducting a pre-startup safety review, or meeting PHA requirements.
2. Program 2 and 3 Requirements for Compliance With RAGAGEP
    The current RMP regulations outline two different, albeit similar,
ways to comply with RAGAGEP. First, the requirement for Program 2
processes at 68.48(b) states: ``The owner or operator shall ensure that
the process is designed in compliance with recognized and generally
accepted good engineering practices. Compliance with Federal or State
regulations that address industry-specific safe design or with
industry-specific design codes and standards may be used to demonstrate
compliance with this paragraph.'' Second, the requirement for Program 3
processes at 40 CFR 68.65(d)(2) states: ``The owner or operator shall
document that equipment complies with recognized and generally accepted
good engineering practices.''
    EPA is therefore proposing to harmonize these two provisions so
that the requirements are identical. EPA has found that the distinction
between ``ensure'' for Program 2 processes and ``document'' for Program
3 processes creates confusion. Additionally, the language for Program 3
refers to ``equipment,'' while the language of Program 2 refers to the
``process.'' Requiring facilities to document compliance, rather than
merely ``ensure'' compliance, removes this ambiguity. EPA is also
proposing to remove the sentence ``Compliance with Federal or State
regulations that address industry-specific safe design or with
industry-specific design codes and standards may be used to demonstrate
compliance with this paragraph.'' In some cases, Federal or State
regulations lag behind current RAGAGEP and thus do not provide the same
level of protection. For example, OSHA recognized that OSHA's flammable
liquid standard at 49 CFR 1910.106 is not as up to date as NFPA or
International Fire Code standards for flammable liquids.\323\ EPA
therefore proposes to replace both provisions to indicate that the
owner or operator shall ensure and document that the process is
designed in compliance with RAGAGEP.
---------------------------------------------------------------------------

    \323\ https://www.osha.gov/laws-regs/standardinterpretations/2001-08-27.
---------------------------------------------------------------------------

3. Retention of Hot Work Permits
    The requirement to issue a hot work permit,\324\ including
documentation of necessary fire protection and prevention measures, is
currently in the RMP regulation only for Program 3 processes. Pursuant
to 40 CFR 68.85(b), ``The permit shall be kept on file until completion
of the hot work operations.''
---------------------------------------------------------------------------

    \324\ 40 CFR 68.3: ``Hot work means work involving electric or
gas welding, cutting, brazing, or similar flame or spark-producing
operations.''
---------------------------------------------------------------------------

    Under the existing RMP regulations, it can be difficult for
implementing agencies to determine if the facility has been conducting
hot work in compliance with the requirements of 40 CFR 68.85, unless
the facility is conducting hot work at the time of the inspection and
has hot work permits on file. Adding a requirement to retain hot work
permits after the completion of operations would address this issue.
    Therefore, EPA is proposing to require retention of hot work
permits for 5 years, in accordance with the recordkeeping requirements
in 40 CFR 68.200.\325\ Implementing agencies would be able to determine
whether: (1) The owner or operator of the facility had any hot work
permits, and (2) the hot work permits are in compliance with the
documentation requirements of 40 CFR 68.85(b).\326\ EPA seeks comment
on this proposed hot work provision amendment.
---------------------------------------------------------------------------

    \325\ 40 CFR 68.200: ``The owner or operator shall maintain
records supporting the implementation of this part at the stationary
source for five years, unless otherwise provided in subpart D of
this part.''
    \326\ 40 CFR 68.85(b): ``The permit shall document that the fire
prevention and protection requirements in 29 CFR 1910.252(a) have
been implemented prior to beginning the hot work operations; it
shall indicate the date(s) authorized for hot work; and identify the
object on which hot work is to be performed. The permit shall be
kept on file until completion of the hot work operations.''
---------------------------------------------------------------------------

4. Storage Incident to Transportation
    Currently, under 40 CFR 68.3, the term ``stationary source'' does
not apply to transportation activities, including storage incident to
transportation for any regulated substance or any other extremely
hazardous substance.\327\ A stationary source does include
transportation containers connected to loading/unloading equipment or
used for storage not incident to transportation, but the term ``storage
not incident to transportation'' is not defined in the RMP regulations.
Preamble language and responses to frequently asked questions posted on
the Agency's website clarify that a container is considered to be in
transportation as long as it is attached to the motive power (e.g.,
truck or locomotive) that delivered it to the site.328 329
If the tank car is detached

from the motive power, and therefore no longer in transportation, the
contents of the tank car must be considered in the threshold
determination.
---------------------------------------------------------------------------

    \327\ ``Stationary source'' is defined at 40 CFR 68.3 as
follows: ``Stationary source means any buildings, structures,
equipment, installations, or substance emitting stationary
activities which belong to the same industrial group, which are
located on one or more contiguous properties, which are under the
control of the same person (or persons under common control), and
from which an accidental release may occur. The term stationary
source does not apply to transportation, including storage incident
to transportation, of any regulated substance or any other extremely
hazardous substance under the provisions of this part. A stationary
source includes transportation containers used for storage not
incident to transportation and transportation containers connected
to equipment at a stationary source for loading or unloading.
Transportation includes, but is not limited to, transportation
subject to oversight or regulation under 49 CFR parts 192, 193, or
195, or a State natural gas or hazardous liquid program for which
the State has in effect a certification to DOT under 49 U.S.C.
60105. A stationary source does not include naturally occurring
hydrocarbon reservoirs. Properties shall not be considered
contiguous solely because of a railroad or pipeline right-of-way.''
    \328\ EPA, List of Regulated Substances and Thresholds for
Accidental Release Prevention; Amendments, 40 CFR part 68 (January
6, 1998).
    \329\ EPA, ``Are Chemicals in a Tank Car Exempt from Threshold
Determinations Under 40 CFR part 68?'' last modified September 1,
2021, https://www.epa.gov/rmp/are-chemicals-tank-car-exempt-threshold-determinations-under-40-cfr-part-68.
---------------------------------------------------------------------------

    EPA is proposing additional regulatory language that includes a
specified number of hours that a transportation container may be
disconnected from the motive power that delivered it to the site before
being considered part of the stationary source. EPA believes that this
provision would provide clarity for regulated parties and implementing
agencies on whether a transportation container used for onsite storage
must be incorporated into a facility's risk management plan. EPA is
proposing to apply a 48-hour time frame to this term based on the
Department of Transportation (DOT), Pipeline and Hazardous Materials
Safety Administration, Carriage by Rail regulations at 49 CFR
174.14(a), that indicate rail carriers must forward each shipment of
hazardous materials promptly within 48 hours after acceptance or
receipt. EPA seeks comment on this 48-hour time frame, suggestions for
other appropriate time frames, and any safety concerns that may arise
from transportation containers being exempt from the RMP regulations
when disconnected for less than 48 hours. The 48 hours would be the
total amount of time, such that a railyard could not move a rail car
around in the railyard using a mobile railcar mover to start the clock
again.
    EPA is also proposing to modify the definition of stationary source
to further clarify ``storage incident to transportation'' in 40 CFR
68.3 by adding an explanation to the transportation container language
in the stationary source definition. The proposed regulatory text would
add examples of what a transportation container could be, such as a
truck or railcar, and that for RMP purposes, railyards and other
stationary sources actively engaged in transloading activities may
store regulated substances up to 48 hours total in a disconnected
transportation container without counting the regulated substances
contained in that transportation container toward the regulatory
threshold.
5. Retail Facility Exemption
    The current definition of ``retail facility'' at 40 CFR 68.3 is ``a
stationary source at which more than one-half of the income is obtained
from direct sales to end users or at which more than one-half of the
fuel sold, by volume, is sold through a cylinder exchange program.''
    The period of sales to end users is unclear; it lacks a definite
time frame in which to calculate whether more than one-half of the
facility's direct sales are to end users. Specifying a definite period
of time would eliminate this uncertainty and allow owners and operators
to determine more accurately whether regulated substances in a process
are subject to the RMP provisions. It also may reduce the amount of
sales documentation that the owner or operator of a regulated facility
must provide to establish its status as a retail facility.
    EPA is therefore proposing to adjust the regulatory text to clarify
that the definition of ``retail facility'' is one in which more than
one-half of the ``annual'' income ``in the previous calendar year'' is
obtained from direct sales to end users or at which more than one-half
of the fuel sold over that period, by volume, is sold through a
cylinder exchange program. EPA is proposing one year of sales activity
because the Agency believes it captures the seasonality of propane
sales at propane distribution facilities. EPA seeks comment on the
proposed annual time frame for sales documentation.
6. RAGAGEP
    EPA initially looks to the latest version of industry codes,
standards, and guidelines to determine whether an owner or operator has
documented compliance with RAGAGEP under 40 CFR 68.65(d)(2), given that
40 CFR part 68 does not define the phrase ``recognized and generally
accepted good engineering practices.'' EPA believes this application
makes sense, because the plain meaning of the phrase is that practices
should be ``recognized,'' ``good,'' and ``generally accepted'' and the
latest version of RAGAGEP contains industry's most up-to-date
assessment of practices that meet these criteria. Also, under the
structure of the CAA, stationary sources subject to 40 CFR part 68 are
also subject to the GDC in 42 U.S.C. 7412(r)(1).\330\ Neither the text
nor the legislative history of the GDC mentions locking obsolete
industry standards into place. EPA also believes there is no practical
reason to have a stricter standard for facilities that are subject to
the GDC, but not to 40 CFR part 68.\331\ Further, a facility subject to
the GDC may have RMP-regulated substances in amounts lower than the RMP
regulatory threshold.
---------------------------------------------------------------------------

    \330\ See 40 CFR 68.1.
    \331\ For example, subjecting facilities with 5,000 lbs. of
anhydrous ammonia, which are subject only to the GDC, to higher
standards than a facility with 50,000 pounds, which would be subject
to 40 CFR part 68.
---------------------------------------------------------------------------

    To address these concerns, EPA is proposing that the RMP
regulations clarify that PHAs must include an analysis of the most
recently promulgated RAGAGEP in order to identify any gaps between
practices related to the facility's design, maintenance, and operation
and the most current version of RAGAGEP.
    EPA is also proposing to require owners or operators to specify in
their risk management plans why PHA recommendations associated with
adopting practices from the most recent version of RAGAGEP are not
implemented. EPA is proposing to adopt three of the four rationales
identified in section IV.A.1.e of this preamble.\332\ EPA is not
proposing to adopt the rationale that ``[t]he recommendation is not
necessary to protect public receptors,'' because there are many safety
measures such as pipe labeling, training, and some standard operating
procedures that do not directly affect public receptors, but that can
have indirect or secondary effects on responders or public receptors.
By allowing owners or operators to screen out recommendations that do
not directly affect public receptors, the Agency is concerned that
facilities may discount important recommendations. For this provision,
the Agency is also proposing to modify the rationale that ``[a]n
alternative measure would provide a sufficient level of protection'' by
adding that the safety measures adopted in lieu of the ones recommended
by the PHA team must be recognized and generally accepted. This will
help ensure that facilities do not ignore updated RAGAGEP when making
decisions about which PHA recommendations to accept or reject. EPA
seeks comment on the proposed rationales for not adopting practices
from the most recent version of RAGAGEP.
---------------------------------------------------------------------------

    \332\ The four rationales are: 1. The analysis upon which the
recommendation is based contains material factual errors. 2. The
recommendation is not necessary to protect to protect public
receptors. 3. An alternative measure would provide a sufficient
level of protection. 4. The recommendation is infeasible.
---------------------------------------------------------------------------

E. Compliance Dates

    The initial 1996 RMP rule was applied 3 years after promulgation of
the rule on June 20, 1996, which is consistent with the last sentence
of CAA section 112(r)(7)(B)(i). The statute does not directly address
when amendments should become applicable. The provisions of this
proposal modify terms of the existing rule, and, in some cases,

amplify or clarify existing requirements. Therefore, in modifications
to 40 CFR 68.10, EPA is proposing to:
     Require regulated sources to comply with new STAA,
incident investigation root cause analysis, third-party compliance
audit, employee participation, emergency response public notification
and exercise evaluation reports, and information availability
provisions, unless otherwise stated, 3 years after the effective date
of the final rule (i.e., FR publication date).
     Require regulated sources to comply with the revised
emergency response field exercise frequency provision by March 15,
2027, or within 10 years of the date of an emergency response field
exercise conducted between March 15, 2017, and August 31, 2022 in
accordance with 40 CFR 68.96(b)(1)(ii).
     Allow regulated sources 1 additional year (i.e., 4 years
after the effective date of the final rule) to update and resubmit risk
management plans to reflect new and revised data elements.
    For STAA, this means that by 3 years after the effective date of
the final rule, the owner or operator of a source with a regulated RMP
process involving HF alkylation, or a source with a process in NAICS
code 324 or 325, located within 1 mile of another NAICS code 324 or 325
RMP facility process, must have completed or updated their PHA to
include an STAA. Recognizing that some facilities may have performed
PHAs recently or may be due to perform PHAs shortly after EPA issues a
final rule, the Agency seeks comment on a second option for STAA
compliance, which would require any stationary source that must perform
STAA as part of its PHA to comply with the STAA requirement for PHAs
performed after 1 year from the date of the final rule.
    For incident investigation root cause analysis, this means that the
owner or operator of a source that experiences any RMP-reportable
accident more than 3 years after the effective date of the rule must
conduct a root cause analysis for their incident investigation of the
accident.
    For third-party compliance audits, this means that the owner or
operator of a source where a second RMP-reportable accident occurs
within 5 years--or of a source where one reportable accident in an RMP-
regulated process in NAICS code 324 or 325, located within 1 mile of
another source's RMP-regulated NAICS code 324 or 325 process, occurs
after 3 years of the effective date of the final rule--must obtain a
third-party audit for their next required compliance audit.
    For employee participation, this means that by 3 years after the
effective date of the final rule, the owner or operator of a source
must have updated or developed--and begun implementing--an employee
participation plan that addresses employee consultation when resolving
PHA, compliance audit, and incident investigation recommendations and
decisions; stop work authorities; and RMP accident and non-compliance
reporting.
    For emergency response, the proposed provisions means that by 3
years after the effective date of the final rule, the owner or operator
of a non-responding source must have onsite documentation of emergency
response public notification procedures. It also means that by 3 years
after the effective date of the final rule, owners or operators of non-
responding and responding sources must have the means to ensure that a
community notification system is in place to warn the public of
releases. It also means that for any RMP-reportable accident occurring
more than 3 years after the effective date of the final rule, sources
must provide appropriate and timely data and information to local
responders detailing their current understanding and best estimates of
the nature of the release. It also means that by 3 years after the
effective date of the rule, emergency exercise evaluation reports must
include documentation of specific exercise elements.
    For information availability, this means that by 3 years after the
effective date of the final rule, the owner or operator must make the
required chemical hazard information available to the public upon
request and provide notification to the public that the information is
available.
    EPA is proposing to provide this 3-year phase-in for several
reasons. First, the initial 1996 RMP rule required compliance per the
statute within 3 years. EPA believes the proposed provisions outlined
today are not as extensive as developing a full RMP program. While some
may argue that some sources already had an accident prevention program
in place due to the OSHA PSM standard, some facilities did not, yet the
rule still required development and compliance within 3 years.
Therefore, EPA does not believe compliance with these proposed
provisions should require a longer time frame than compliance with the
initial rule. Second, while EPA believes that for most sources,
activities associated with these proposed provisions may reasonably
require significant time to complete, the 3-year phase-in is as
expeditious as practicable considering the circumstances. For example,
the new incident investigation root cause analysis, employee
participation, emergency response, and information availability
requirements will involve training and program development activities.
For the third-party audit provisions, the extended compliance timeframe
will allow potential auditors enough time to meet the competency and
independence criteria necessary to serve as a third-party auditor. EPA
believes that in many cases, sources subject to the STAA provisions
will prefer to perform a full PHA update when implementing the STAA
requirements. Sources subject to STAA provisions are among the largest
and most complex sources regulated under 40 CFR part 68, and therefore,
PHAs and PHA updates at these sources typically require a significant
level of effort. Since PHA updates are normally done at 5-year
intervals, EPA believes it would be appropriate to allow most sources
to adopt these provisions in their normal PHA update cycle if they so
choose. For the emergency response provisions, evaluating and securing
resources for public notification systems and the associated training
with local responders will take time to be coordinated. Lastly, EPA
intends to publish guidance for certain provisions, such as STAA,
incident investigation root cause analysis, third-party audits,
employee participation, and emergency response. Once these materials
are complete, owners and operators will need time to familiarize
themselves with the new materials and incorporate them into their risk
management programs.
    For field exercises, EPA is proposing to require the owners or
operators of sources to have planned, scheduled, and conducted their
first field exercise by March 15, 2027. For this provision, EPA is
proposing to revert to the original timeframe in the 2017 amendments
rule, based on the Agency's view that this change will allow local
authorities to set longer time periods to address the major concern
that the 2019 reconsideration rule identified with the practicability
of the 2017 date, which was the potential inability of local
authorities to voluntarily participate in the exercises when they had
multiple facilities in their jurisdiction.
    EPA is also proposing to provide 1 additional year for owners or
operators to update risk management plans to reflect proposed new or
revised data elements in subpart G of the regulations. The additional
year will allow owners and operators an opportunity to begin to comply
with the new or revised regulatory provisions prior to certifying

compliance in the risk management plan. Additionally, the Agency will
need to make significant revisions to its online risk management plan
submission system, RMP*eSubmit, to accommodate the newly required and
revised data elements, and sources will not be able to update risk
management plans with new or revised data elements until the submission
system is ready. Also, once it is ready, allowing an additional year
for sources to update risk management plans will prevent potential
problems with thousands of sources submitting updated risk management
plans on the same day.

V. Additional Considerations

    EPA acknowledges the need for reviewing the list of RMP-regulated
substances. Section 112(r)(3) requires periodic review of the RMP
regulated substance list. A priority chemical for EPA's upcoming review
will be ammonium nitrate. EPA also acknowledges the need for
considering expanding fenceline monitoring for RMP-regulated
facilities. While EPA is considering both of these issues for a future
action, they are beyond the scope of this NPRM. EPA welcomes comment on
these issues which are further discussed in the Technical Background
Document.\333\
---------------------------------------------------------------------------

    \333\ Technical Background Document for Notice of Proposed
Rulemaking: Risk Management Programs Under the Clean Air Act,
Section 112(r)(7); Safer Communities by Chemical Accident Prevention
(April 19, 2022).
---------------------------------------------------------------------------

VI. Statutory and Executive Orders Reviews

    Additional information about these statutes and Executive Orders
can be found at https://www.epa.gov/laws-regulations/laws-and-executive-orders.

A. Executive Order 12866: Regulatory Planning and Review and Executive
Order 13563: Improving Regulation and Regulatory Review

    This action is an economically significant regulatory action that
was submitted to the Office of Management and Budget (OMB) for review.
Any changes made in response to OMB recommendations have been
documented in the docket. The EPA prepared a Regulatory Impact Analysis
(RIA) of the potential costs and benefits associated with this action.
This RIA is available in the docket (Docket ID Number EPA-HQ-OLEM-2022-
0174). Chapters 4-6 of the RIA developed for this proposed action
provide additional details on costs and benefits.

B. Paperwork Reduction Act (PRA)

    The information collection activities in this proposed rule will be
submitted for approval to the OMB under the PRA. The Information
Collection Request (ICR) document that the EPA prepared has been
assigned EPA ICR number 2725.01. A copy of the ICR is available in the
docket for this rule, and it is briefly summarized here.
    This new ICR adds new information collection activities related to
a previously approved ICR (1656.18), OMB Control No. 2050-0144. That
ICR covers the Risk Management Program rule, originally promulgated on
June 20, 1996; and the current rule, including previous amendments,
codified as 40 CFR part 68. This ICR addresses the proposed information
requirements that are part of the proposed revision to the rule.
    EPA believes that the Risk Management Program regulations have been
effective in preventing and mitigating chemical accidents in the United
States. However, EPA believes that revisions could further protect
human health and the environment from chemical hazards through
advancement of process safety management based on lessons learned.
These revisions are a result of review of the existing Risk Management
Program and information gathered from the 2021 listening sessions.
State and local authorities will use the information in RMPs to modify
and enhance their community response plans. The agencies implementing
the RMP rule will use RMPs to evaluate compliance with part 68 and to
identify sources for inspection because they may pose significant risks
to the community. Citizens may use the information to assess and
address chemical hazards in their communities and to respond
appropriately in the event of a release of a regulated substance. These
revisions are a result of a review of the existing Risk Management
Program and are proposed under the statutory authority provided by
section 112(r) of the CAA as amended (42 U.S.C. 7412(r)).
    Respondents/affected entities: The industries that are likely to be
affected by the requirements in the proposed regulation fall into
numerous NAICS codes. The types of stationary sources affected by the
proposed rule range from petroleum refineries and large chemical
manufacturers to water and wastewater treatment systems; chemical and
petroleum wholesalers and terminals; food manufacturers, packing
plants, and other cold storage facilities with ammonia refrigeration
systems; agricultural chemical distributors; midstream gas plants; and
a limited number of other sources that use RMP-regulated substances.
Among the stationary sources potentially affected, the Agency has
determined that 2,911 are regulated private sector small entities and
630 are small government entities.
    Respondent's obligation to respond: Mandatory ((CAA sections
112(r)(7)(B)(i) and (ii), CAA section 112(r)(7)(B)(iii), 114(c), CAA
114(a)(1))).
    Estimated number of respondents: 14,226.
    Frequency of response: On occasion.
    Total estimated burden: 797,642 hours (per year). Burden is defined
at 5 CFR 1320.3(b).
    Total estimated cost: $79,248,522 (per year); includes $2,817,907
annual operations and maintenance costs and $78,400 annual capital
costs.
    An agency may not conduct or sponsor, and a person is not required
to respond to, a collection of information unless it displays a
currently valid OMB control number. The OMB control numbers for the
EPA's regulations in 40 CFR are listed in 40 CFR part 9.
    Submit comments on the Agency's need for this information, the
accuracy of the provided burden estimates, and any suggested methods
for minimizing respondent burden to the EPA using the docket identified
at the beginning of this rule. The EPA will respond to any ICR-related
comments in the final rule. You may also send your ICR-related comments
to OMB's Office of Information and Regulatory Affairs using the
interface at www.reginfo.gov/public/do/PRAMain. Find this particular
information collection by selecting ``Currently under Review--Open for
Public Comments'' or by using the search function. OMB must receive
comments no later than October 31, 2022.

C. Regulatory Flexibility Act (RFA)

    I certify that this action will not have a significant economic
impact on a substantial number of small entities under the RFA. The
small entities subject to the requirements of this action include small
businesses and small governmental entities. The Agency has determined
that among the 2,911 potentially regulated private sector small
entities so impacted, 2,822, or 96.9 percent, may experience an impact
of less than one percent with an average small entity cost of $10,618;
and 84, or 2.9 percent, may experience an impact of between one and
three percent of revenues with an average small cost entity of
$108,921. The industry sectors of Farm Product Warehousing and Storage,
and All Other

Miscellaneous Chemical Product and Preparations Manufacturing had the
most entities potentially affected between one and three percent of
revenues, with 5 and 6 entities, respectively. For detailed costs by
provision and NAICS code see Chapter 8 of the RIA.
    Among the 630 small government entities potentially affected, 488,
or 77 percent would incur costs of less than $1,000; 109, or 17 percent
costs ranging from $1,000 to $2,000; 18, or 3 percent costs ranging
from $2,000 to $3,000; and only one would incur costs greater than
$10,000, and EPA estimated that for the rule to have a larger than one
percent impact on this entity, it would need to have revenue of less
than $103 per resident.
    EPA solicits comment on the number of small entities affected and
the estimated cost impacts on small entities. Details of these analyses
are presented in Chapter 8 of the proposed rule RIA, available in the
docket.

D. Unfunded Mandates Reform Act (UMRA)

    This action does not include any Federal mandate that may result in
the expenditure by State, local, and Tribal governments, in the
aggregate, or by the private sector, of $100 million or more (adjusted
for inflation) in any one year and does not significantly or uniquely
affect small governments, as described in the Unfunded Mandates Reform
Act of 1995 (2 U.S.C. 1531-1538).

E. Executive Order 13132: Federalism

    This action does not have federalism implications. It will not have
substantial direct effects on the states, on the relationship between
the national government and the states, or on the distribution of power
and responsibilities among the various levels of government.

F. Executive Order 13175: Consultation and Coordination With Indian
Tribal Governments

    This action has Tribal implications. However, it will neither
impose substantial direct compliance costs on federally recognized
Tribal governments, nor preempt Tribal law. There are approximately 260
RMP facilities located on Tribal lands. Tribes could be impacted by the
final rule either as an owner or operator of an RMP-regulated facility
or as a Tribal government when the Tribal government conducts emergency
response or emergency preparedness activities under EPCRA.
    EPA consulted with Tribal officials under the EPA Policy on
Consultation and Coordination with Indian Tribes on previous RMP
rulemakings. EPA will consult again with Tribal officials as it
develops this regulation to permit them to have meaningful and timely
input into its development. Consultation will include conference calls,
webinars, and meetings with interested Tribal representatives to ensure
that their concerns are addressed before the rule is finalized. In the
spirit of E.O. 13175 and consistent with EPA policy to promote
communications between EPA and Tribal governments, EPA specifically
solicits comment on this proposed rule from Tribal officials.

G. Executive Order 13045: Protection of Children From Environmental
Health Risks and Safety Risks

    This action is not subject to E.O. 13045 because EPA does not
believe the environmental health risks or safety risks addressed by
this action present a disproportionate risk to children. This action's
health and risk assessments are contained in the Chapter 9 of the RIA
for this rule, available in the docket.

H. Executive Order 13211: Actions Concerning Regulations That
Significantly Affect Energy Supply, Distribution, or Use

    This action is not a ``significant energy action'' because it is
not likely to have a significant adverse effect on the supply,
distribution, or use of energy. This action is not anticipated to have
notable impacts on emissions, costs or energy supply decisions for the
affected electric utility industry.

I. National Technology Transfer and Advancement Act (NTTAA)

    This rulemaking does not involve technical standards.

J. Executive Order 12898: Federal Actions To Address Environmental
Justice in Minority Populations and Low-Income Populations

    EPA believes that this action does not have disproportionately high
and adverse human health or environmental effects on minority
populations, low-income populations and/or indigenous peoples, as
specified in E.O. 12898 (59 FR 7629, February 16, 1994). To the extent
that populations living closer to facilities are more likely to be
exposed if an accidental release at an RMP facility occurs, these
releases pose a greater risk to these key demographic groups.
Therefore, the benefits of this regulation would reduce risk for
historically underserved and overburdened populations.
    E.O. 12898 directs Federal agencies, to the greatest extent
practicable and permitted by law, to make EJ part of their mission by
identifying and addressing, as appropriate, disproportionately high and
adverse human health or environmental effects of their programs,
policies and activities on minority populations and low-income
populations in the United States. The consideration of EJ into EPA
rulemaking is guided by two EPA documents: (1) ``Technical Guidance for
Assessing Environmental Justice in Regulatory Analysis'' \334\ and (2)
``Guidance on Considering Environmental Justice During the Development
of Regulatory Action.'' \335\ The first of these documents \336\
establishes the expectation that analysts conduct the highest quality
EJ analysis feasible in support of rulemakings, recognizing that what
is possible will be context specific. One method recommended by the
guidance documents includes screening for potential EJ concerns by
identifying the proximity of regulated sources to historically
underserved and overburdened communities. E.O. 12898 places a
responsibility on Federal agencies for ``identifying and addressing, as
appropriate, disproportionately high and adverse human health or
environmental effects of its programs, policies, and activities on
minority populations and low-income populations in the United States.''
---------------------------------------------------------------------------

    \334\ EPA. (2016). Technical Guidance for Assessing
Environmental Justice in Regulatory Analysis. https://www.epa.gov/sites/production/files/2016-06/documents/ejtg_5_6_16_v5.1.pdf.
    \335\ EPA. (2018). Guidance on Considering Environmental Justice
During the Development of Regulatory Actions. https://www.epa.gov/sites/default/files/2015-06/documents/considering-ej-in-rulemaking-guide-final.pdf.
    \336\ EPA. (2016). Technical Guidance for Assessing
Environmental Justice in Regulatory Analysis. https://www.epa.gov/sites/production/files/2016-06/documents/ejtg_5_6_16_v5.1.pdf.
---------------------------------------------------------------------------

    EPA conducted an EJ analysis using the Agency's EJ screening tool,
EJSCREEN.\337\ The EJ analysis shows that historically underserved and
overburdened populations live within proximity to those facilities (and
thus at greater risk) than other populations. The analysis also found
evidence that included facilities are disproportionately located within
historically underserved and overburdened communities. Thus, EPA
recognizes that accidental releases of regulated chemicals from
facilities regulated by this action would likely pose disproportionate
risks to historically marginalized communities. However, EPA has
concluded that the regulatory requirements will advance

fair treatment of those populations by reducing the disproportionate
damages from accidental releases from RMP-regulated facilities might
otherwise inflict on those populations. EPA's full EJ analysis is
documented in the RIA, which is available in the docket for this
action.
---------------------------------------------------------------------------

    \337\ https://www.epa.gov/ejscreen.
---------------------------------------------------------------------------

List of Subjects in 40 CFR Part 68

    Environmental protection, Administrative practice and procedure,
Air pollution control, Chemicals, Hazardous substances,
Intergovernmental relations, Reporting and recordkeeping requirements.

Michael S. Regan,
Administrator.
    For the reasons stated in the preamble, Title 40, chapter I, part
68, of the Code of Federal Regulations is proposed to be amended as
follows:

PART 68--CHEMICAL ACCIDENT PREVENTION PROVISIONS

0
1. The authority citation for part 68 continues to read as follows:

    Authority:  42 U.S.C. 7412(r), 7601(a)(1), 7661-7661f.
0
2. Amend Sec.  68.3 by
0
a. Adding in alphabetical order definitions for ``Active measures,''
``Inherently safer technology or design'', ``Natural hazard'',
``Passive measures'', ``Practicability'', and ``Procedural measures'';
0
b. Revising the definition of ``Retail facility'';
0
c. Adding in alphabetical order a definition for ``Root cause'';
0
d. Revising the definition of ``Stationary source''; and
0
e. Adding in alphabetical order a definition for ``Third-party audit''.
    The additions and revisions read as follows:

Sec.  68.3  Definitions.

* * * * *
    Active measures mean risk management measures or engineering
controls that rely on mechanical, or other energy input to detect and
respond to process deviations. Examples of active measures include
alarms, safety instrumented systems, and detection hardware (such as
hydrocarbon sensors).
* * * * *
    Inherently safer technology or design means risk management
measures that minimize the use of regulated substances, substitute less
hazardous substances, moderate the use of regulated substances, or
simplify covered processes in order to make accidental releases less
likely, or the impacts of such releases less severe.
* * * * *
    Natural hazard means naturally occurring events that have the
potential for negative impact including meteorological or geologic
hazards. Meteorological hazards include those that naturally occur due
to the weather cycle or climatic cycles, and include flooding,
temperature extremes, snow/ice storms, wildfire, tornado, tropical
cyclones, hurricanes, storm surge, wind, lightening, hailstorms,
drought, etc. Geologic hazards are those occurring due to the movement
of the earth and the internal earth forces, and include seismic events,
earthquakes, landslides, tsunami, volcanic eruptions, and dam rupture.
* * * * *
    Passive measures mean risk management measures that use design
features that reduce either the frequency or consequence of the hazard
without human, mechanical, or other energy input. Examples of passive
measures include pressure vessel designs, dikes, berms, and blast
walls.
* * * * *
    Practicability means the capability of being successfully
accomplished within a reasonable time, accounting for environmental,
legal, social, technological and economic factors. Environmental
factors would include consideration of potential transferred risks for
new risk reduction measures.
    Procedural measures mean risk management measures such as policies,
operating procedures, training, administrative controls, and emergency
response actions to prevent or minimize incidents.
* * * * *
    Retail facility means a stationary source at which more than one-
half of the annual income (in the previous calendar year) is obtained
from direct sales to end users or at which more than one-half of the
fuel sold, by volume, is sold through a cylinder exchange program.
* * * * *
    Root cause means a fundamental, underlying, system-related reason
why an incident occurred.
* * * * *
    Stationary source means any buildings, structures, equipment,
installations, or substance-emitting stationary activities which belong
to the same industrial group, which are located on one or more
contiguous properties, which are under the control of the same person
(or persons under common control), and from which an accidental release
may occur. The term stationary source does not apply to transportation,
including storage incident to transportation, of any regulated
substance or any other extremely hazardous substance under the
provisions of this part. A stationary source includes transportation
containers used for storage not incident to transportation and
transportation containers connected to equipment at a stationary source
for loading or unloading. A transportation container is in storage
incident to transportation as long as it is attached to the motive
power that delivered it to the site (e.g., a truck or locomotive);
however, railyards and other stationary sources actively engaged in
transloading activities may store regulated substances up to 48 hours
total in a disconnected transportation container without counting the
regulated substances contained in that transportation container toward
the regulatory threshold. Transportation includes, but is not limited
to, transportation subject to oversight or regulation under 49 CFR part
192, 193, or 195, or a State natural gas or hazardous liquid program
for which the State has in effect a certification to DOT under 49
U.S.C. 60105. A stationary source does not include naturally occurring
hydrocarbon reservoirs. Properties shall not be considered contiguous
solely because of a railroad or pipeline right-of-way.
    Third-party audit means a compliance audit conducted pursuant to
the requirements of Sec.  68.59 and/or Sec.  68.80, performed or led by
an entity (individual or firm) meeting the competency and independence
requirements described in Sec.  68.59(c) or Sec.  68.80(c).
* * * * *
0
3. Amend Sec.  68.10 by:
0
a. Revising paragraph (a);
0
b. Redesignating paragraphs (g) through (k) as paragraphs (j) through
(n); and
0
c. Adding new paragraphs (g) through (i).
    The revisions and additions read as follows:

Sec.  68.10  Applicability.

    (a) Except as provided in paragraphs (b) through (i) of this
section, an owner or operator of a stationary source that has more than
a threshold quantity of a regulated substance in a process, as
determined under Sec.  68.115, shall comply with the requirements of
this part no later than the latest of the following dates:
    (1) June 21, 1999;

    (2) Three years after the date on which a regulated substance is
first listed under Sec.  68.130;
    (3) The date on which a regulated substance is first present above
a threshold quantity in a process; or
    (4) For any revisions to this part, the effective date of the final
rule.
* * * * *
    (g) By [DATE 3 YEARS AFTER EFFECTIVE DATE OF FINAL RULE], the owner
or operator shall comply with the following provisions promulgated on
[EFFECTIVE DATE OF FINAL RULE]:
    (1) Third-party audit provisions in Sec. Sec.  68.58(f) through
(h), 68.59, 68.79(f) through (h), and 68.80;
    (2) Incident investigation root cause analysis provisions in
Sec. Sec.  68.60(d)(7) and 68.81(d)(7);
    (3) Safer technology and alternatives analysis provisions in Sec.
68.67(c)(8);
    (4) Employee participation provisions in Sec. Sec.  68.62(d)(7) and
68.82(d)(7);
    (5) Emergency response provisions in Sec. Sec.  68.90(b) and
68.95(a).
    (6) Availability of information provisions in Sec.  68.210(d)
through (f).
    (h) By March 15, 2027, or within 10 years of the date of an
emergency response field exercise conducted between March 15, 2017, and
August 31, 2022 in accordance with Sec.  68.96(b)(1)(ii).
    (i) By [DATE 4 YEARS AFTER EFFECTIVE DATE OF FINAL RULE], the owner
or operator shall comply with the risk management plan provisions of
subpart G of this part promulgated on [EFFECTIVE DATE OF FINAL RULUE].

Subpart C--Program 2 Prevention Program

0
4. Amend Sec.  68.48 by revising paragraph (b) to read as follows:

Sec.  68.48  Safety information.

* * * * *
    (b) The owner or operator shall ensure and document that the
process is designed in compliance with recognized and generally
accepted good engineering practices.
* * * * *
0
5. Amend Sec.  68.50 by revising paragraph (a)(3) and adding paragraphs
(a)(5) and (6) to read as follows:

Sec.  68.50  Hazard review.

    (a) * * *
    (3) The safeguards used or needed to control the hazards or prevent
equipment malfunction or human error including standby or emergency
power systems;
* * * * *
    (5) External events such as natural hazards, including those caused
by climate change or other triggering events that could lead to an
accidental release; and
    (6) Stationary source siting, including the placement of processes,
equipment, buildings within the facility, and hazards posed by
proximate facilities, and accidental release consequences posed by
proximity to the public and public receptors.
* * * * *
0
6. Amend Sec.  68.58 by revising paragraph (a) and adding paragraphs
(f) through (h) to read as follows:

Sec.  68.58  Compliance audits.

    (a) The owner or operator shall certify that they have evaluated
compliance with the provisions of this subpart for each covered
process, at least every three years to verify that the procedures and
practices developed under this subpart are adequate and are being
followed. When required as set forth in paragraph (f) of this section,
the compliance audit shall be a third-party audit.
* * * * *
    (f) Third-party audit applicability. The next required compliance
audit shall be a third-party audit when one of the following conditions
applies:
    (1) Two accidental releases within five years meeting the criteria
in Sec.  68.42(a) from a covered process at a stationary source have
occurred; or
    (2) One accidental release within five years meeting the criteria
in Sec.  68.42(a) from a covered process at a stationary source in
NAICS code 324 or 325, located within 1 mile of another stationary
source having a process in NAICS code 324 or 325, has occurred; or
    (3) An implementing agency requires a third-party audit due to
conditions at the stationary source that could lead to an accidental
release of a regulated substance, or when a previous third-party audit
failed to meet the competency or independence criteria of Sec.
68.59(c).
    (g) Implementing agency notification and appeals. (1) If an
implementing agency makes a preliminary determination that a third-
party audit is necessary pursuant to paragraph (f)(3) of this section,
the implementing agency will provide written notice to the owner or
operator that describes the basis for this determination.
    (2) Within 30 days of receipt of such written notice, the owner or
operator may provide information and data to, and may consult with, the
implementing agency on the determination. Thereafter, the implementing
agency will provide a final determination to the owner or operator.
    (3) If the final determination requires a third-party audit, the
owner or operator shall comply with the requirements of Sec.  68.59,
pursuant to the schedule in paragraph (h) of this section.
    (4) Appeals. The owner or operator may appeal a final determination
made by an implementing agency under paragraph (g)(3) of this section
within 30 days of receipt of the final determination. The appeal shall
be made to the EPA Regional Administrator or, for determinations made
by other implementing agencies, the administrator or director of such
implementing agency. The appeal shall contain a clear and concise
statement of the issues, facts in the case, and any relevant additional
information. In reviewing the appeal, the implementing agency may
request additional information from the owner or operator. The
implementing agency will provide a written, final decision on the
appeal to the owner or operator.
    (h) Schedule for conducting a third-party audit. The audit and
audit report shall be completed as follows, unless a different
timeframe is specified by the implementing agency:
    (1) For third-party audits required pursuant to paragraph (f)(1) of
this section, within 12 months of the second of two releases within
five years; or
    (2) For third-party audits required pursuant to paragraph (f)(2) of
this section, within 12 months of the release; or
    (3) For third-party audits required pursuant to paragraph (f)(3) of
this section, within 12 months of the date of the final determination
pursuant to paragraph (g)(3) of this section. However, if the final
determination is appealed pursuant to paragraph (g)(4) of this section,
within 12 months of the date of the final decision on the appeal.
0
7. Section 68.59 is added to read as follows:

Sec.  68.59  Third-party audits.

    (a) Applicability. The owner or operator shall engage a third party
to conduct an audit that evaluates compliance with the provisions of
this subpart in accordance with the requirements of this section when
any criterion of Sec.  68.58(f) is met.
    (b) Third-party auditors and auditing teams. The owner or operator
shall either:
    (1) Engage a third-party auditor meeting all of the competency and
independence criteria in paragraph (c) of this section; or

    (2) Assemble an auditing team, led by a third-party auditor meeting
all of the competency and independence criteria in paragraph (c) of
this section. The team may include:
    (i) Other employees of the third-party auditor firm meeting the
independence criteria of paragraph (c)(2) of this section; and
    (ii) Other personnel not employed by the third-party auditor firm,
including facility personnel.
    (c) Third-party auditor qualifications. The owner or operator shall
determine and document that the third-party auditor(s) meet the
following competency and independence requirements:
    (1) Competency requirements. The third-party auditor(s) shall be:
    (i) Knowledgeable with the requirements of this part;
    (ii) Experienced with the stationary source type and processes
being audited and applicable recognized and generally accepted good
engineering practices; and
    (iii) Trained and/or certified in proper auditing techniques.
    (2) Independence requirements. The third-party auditor(s) shall:
    (i) Act impartially when performing all activities under this
section;
    (ii) Receive no financial benefit from the outcome of the audit,
apart from payment for auditing services. For purposes of this
paragraph, retired employees who otherwise satisfy the third-party
auditor independence criteria in this section may qualify as
independent if their sole continuing financial attachments to the owner
or operator are employer-financed or managed retirement and/or health
plans;
    (iii) Ensure that all third-party personnel involved in the audit
sign and date a conflict of interest statement documenting that they
meet the independence criteria of this paragraph (c)(2); and
    (iv) Ensure that all third-party personnel involved in the audit do
not accept future employment with the owner or operator of the
stationary source for a period of at least two years following
submission of the final audit report. For purposes of this requirement,
employment does not include performing or participating in third-party
audits pursuant to Sec.  68.59 or Sec.  68.80.
    (3) The auditor shall have written policies and procedures to
ensure that all personnel comply with the competency and independence
requirements of this section.
    (d) Third-party auditor responsibilities. The owner or operator
shall ensure that the third-party auditor:
    (1) Manages the audit and participates in audit initiation, design,
implementation, and reporting;
    (2) Determines appropriate roles and responsibilities for the audit
team members based on the qualifications of each team member;
    (3) Prepares the audit report and where there is a team, documents
the full audit team's views in the final audit report;
    (4) Certifies the final audit report and its contents as meeting
the requirements of this section; and
    (5) Provides a copy of the audit report to the owner or operator.
    (e) Audit report. The audit report shall:
    (1) Identify all persons participating on the audit team, including
names, titles, employers and/or affiliations, and summaries of
qualifications. For third-party auditors, include information
demonstrating that the competency requirements in paragraph (c)(1) of
this section are met;
    (2) Describe or incorporate by reference the policies and
procedures required under paragraph (c)(3) of this section;
    (3) Document the auditor's evaluation, for each covered process, of
the owner or operator's compliance with the provisions of this subpart
to determine whether the procedures and practices developed by the
owner or operator under this rule are adequate and being followed;
    (4) Document the findings of the audit, including any identified
compliance or performance deficiencies;
    (5) Summarize any significant revisions (if any) between draft and
final versions of the report; and
    (6) Include the following certification, signed and dated by the
third-party auditor or third-party audit team member leading the audit:

    ``I certify that this RMP compliance audit report was prepared
under my direction or supervision in accordance with a system
designed to assure that qualified personnel properly gather and
evaluate the information upon which the audit is based. I further
certify that the audit was conducted and this report was prepared
pursuant to the requirements of subpart C of 40 CFR part 68 and all
other applicable auditing, competency, independence, impartiality,
and conflict of interest standards and protocols. Based on my
personal knowledge and experience, and inquiry of personnel involved
in the audit, the information submitted herein is true, accurate,
and complete.''

    (f) Third-party audit findings--(1) Findings response report. As
soon as possible, but no later than 90 days after receiving the final
audit report, the owner or operator shall determine an appropriate
response to each of the findings in the audit report, and develop a
findings response report that includes:
    (i) A copy of the final audit report;
    (ii) An appropriate response to each of the audit report findings;
    (iii) A schedule for promptly addressing deficiencies; and
    (iv) A certification, signed and dated by a senior corporate
officer, or an official in an equivalent position, of the owner or
operator of the stationary source, stating:

    ``I certify under penalty of law that I have engaged a third
party to perform or lead an audit team to conduct a third-party
audit in accordance with the requirements of 40 CFR 68.59 and that
the attached RMP compliance audit report was received, reviewed, and
responded to under my direction or supervision by qualified
personnel. I further certify that appropriate responses to the
findings have been identified and deficiencies were corrected, or
are being corrected, consistent with the requirements of subpart C
of 40 CFR part 68, as documented herein. Based on my personal
knowledge and experience, or inquiry of personnel involved in
evaluating the report findings and determining appropriate responses
to the findings, the information submitted herein is true, accurate,
and complete. I am aware that there are significant penalties for
making false material statements, representations, or
certifications, including the possibility of fines and imprisonment
for knowing violations.''

    (2) Schedule implementation. The owner or operator shall implement
the schedule to address deficiencies identified in the audit findings
response report in paragraph (f)(1)(iii) of this section and document
the action taken to address each deficiency, along with the date
completed.
    (3) Submission to Board of Directors. The owner or operator shall
immediately provide a copy of each document required under paragraphs
(f)(1) and (2) of this section, when completed, to the owner or
operator's audit committee of the Board of Directors, or other
comparable committee or individual, if applicable.
    (g) Recordkeeping. The owner or operator shall retain at the
stationary source, the two most recent final third-party audit reports,
related findings response reports, documentation of actions taken to
address deficiencies, and related records. This requirement does not
apply to any document that is more than five years old.
0
8. Amend Sec.  68.60 by adding paragraph (h) to read as follows:

Sec.  68.60  Incident investigation.

* * * * *

    (h) The owner or operator shall ensure the following are addressed
when the incident in Sec.  68.60(a) meets the accident history
reporting requirements under Sec.  68.42:
    (1) The report shall be completed within 12 months of the incident,
unless the implementing agency approves, in writing, to an extension of
time.
    (2) The report in paragraph (d) of this section shall include
factors that contributed to the incident including the initiating
event, direct and indirect contributing factors, and root causes. Root
causes shall be determined by conducting an analysis for each incident
using a recognized method.
0
9. Section 68.62 is added to subpart C to read as follows:

Sec.  68.62  Employee participation.

    (a) The owner or operator shall develop a written plan of action
regarding the implementation of the employee participation required by
this section.
    (b) The owner or operator shall develop and implement a process to
allow employees and their representatives to anonymously report
unaddressed hazards that could lead to a catastrophic release,
unreported RMP-reportable accidents, or any other noncompliance with
this part.
    (c) The owner or operator shall provide to employees and their
representatives access to hazard reviews and to all other information
required to be developed under this rule.

Subpart D--Program 3 Prevention Program

0
10. Amend Sec.  68.65 by revising paragraphs (a) and (d)(2) to read as
follows:

Sec.  68.65  Process safety information.

    (a) The owner or operator shall complete a compilation of written
process safety information before conducting any process hazard
analysis required by the rule and shall keep process safety information
up to date. The compilation of written process safety information is to
enable the owner or operator and the employees involved in operating
the process to identify and understand the hazards posed by those
processes involving regulated substances. This process safety
information shall include information pertaining to the hazards of the
regulated substances used or produced by the process, information
pertaining to the technology of the process, and information pertaining
to the equipment in the process.
* * * * *
    (d) * * *
    (2) The owner or operator shall ensure and document that the
process is designed and maintained in compliance with recognized and
generally accepted good engineering practices.
* * * * *
0
11. Amend Sec.  68.67 by revising paragraphs (c)(3) and (5) and adding
paragraph (c)(8) through (10) to read as follows:

Sec.  68.67  Process hazard analysis.

* * * * *
    (c) * * *
    (3) Engineering and administrative controls applicable to the
hazards and their interrelationships such as appropriate application of
detection methodologies to provide early warning of releases and
standby or emergency power systems.
* * * * *
    (5) Stationary source siting, including the placement of processes,
equipment, and buildings within the facility, hazards posed by
proximate facilities, and potential accidental release consequences to
nearby public and environmental receptors;
* * * * *
    (8) External events such as natural hazards, including those caused
by climate change or other triggering events that could lead to an
accidental release;
    (9) For processes in NAICS codes 324 and 325, located within 1 mile
of another stationary source having a process in NAICS codes 324 or 325
and for processes in NAICS 324 with hydrofluoric acid alkylation
processes, safer technology and alternative risk management measures
applicable to eliminating or reducing risk from process hazards.
    (i) The owner or operator shall consider and document, in the
following order of preference inherently safer technology or design,
passive measures, active measures, and procedural measures. A
combination of risk management measures may be used to achieve the
desired risk reduction.
    (ii) The owner or operator shall determine and document the
practicability of the inherently safer technologies and designs
considered. The owner or operator shall include in documentation any
methods used to determine practicability. For any inherently safer
technologies and designs implemented, the owner or operator shall
document and submit to EPA a description of the technology implemented.
    (iii) The analysis shall be performed by a team that includes
members with expertise in the process being evaluated, including at
least one member who works in the process. The team members shall be
documented.
    (10) Any gaps in safety between the codes, standards, or practices
to which the process was designed and constructed and the most current
version of applicable codes, standards, or practices.
* * * * *
0
12. Amend Sec.  68.79 by revising paragraph (a) and adding paragraphs
(f) through (h) to read as follows:

Sec.  68.79  Compliance audits.

    (a) The owner or operator shall certify that they have evaluated
compliance with the provisions of this subpart for each covered
process, at least every three years to verify that the procedures and
practices developed under the subpart are adequate and are being
followed. When required as set forth in paragraph (f) of this section,
the compliance audit shall be a third-party audit.
* * * * *
    (f) Third-party audit applicability. The next required compliance
audit shall be a third-party audit when one or more of the following
conditions applies:
    (1) Two accidental releases within five years meeting the criteria
in Sec.  68.42(a) from a covered process at a stationary source has
occurred; or
    (2) One accidental release within five years meeting the criteria
in Sec.  68.42(a) from a covered process at a stationary source in
NAICS code 324 or 325, located within 1 mile of another stationary
source having a process in NAICS code 324 or 325; or
    (3) An implementing agency requires a third-party audit due to
conditions at the stationary source that could lead to an accidental
release of a regulated substance, or when a previous third-party audit
failed to meet the competency or independence criteria of Sec.
68.80(c).
    (g) Implementing agency notification and appeals. (1) If an
implementing agency makes a preliminary determination that a third-
party audit is necessary pursuant to paragraph (f)(3) of this section,
the implementing agency will provide written notice to the owner or
operator that describes the basis for this determination.
    (2) Within 30 days of receipt of such written notice, the owner or
operator may provide information and data to, and may consult with, the
implementing agency on the determination. Thereafter, the implementing
agency will provide a final determination to the owner or operator.

    (3) If the final determination requires a third-party audit, the
owner or operator shall comply with the requirements of Sec.  68.80,
pursuant to the schedule in paragraph (h) of this section.
    (4) Appeals. The owner or operator may appeal a final determination
made by an implementing agency under paragraph (g)(3) of this section
within 30 days of receipt of the final determination. The appeal shall
be made to the EPA Regional Administrator or, for determinations made
by other implementing agencies, the administrator or director of such
implementing agency. The appeal shall contain a clear and concise
statement of the issues, facts in the case, and any relevant additional
information. In reviewing the appeal, the implementing agency may
request additional information from the owner or operator. The
implementing agency will provide a written, final decision on the
appeal to the owner or operator.
    (h) Schedule for conducting a third-party audit. The audit and
audit report shall be completed as follows, unless a different
timeframe is specified by the implementing agency:
    (1) For third-party audits required pursuant to paragraph (f)(1) of
this section, within 12 months of the second of two releases within
five years; or
    (2) For third-party audits required pursuant to paragraph (f)(2) of
this section, within 12 months of the release; or
    (3) For third-party audits required pursuant to paragraph (f)(3) of
this section, within 12 months of the date of the final determination
pursuant to paragraph (g)(3) of this section. However, if the final
determination is appealed pursuant to paragraph (g)(4) of this section,
within 12 months of the date of the final decision on the appeal.
0
13. Section 68.80 is added to read as follows:

Sec.  68.80  Third-party audits.

    (a) Applicability. The owner or operator shall engage a third party
to conduct an audit that evaluates compliance with the provisions of
this subpart in accordance with the requirements of this section when
any criterion of Sec.  68.79(f) is met.
    (b) Third-party auditors and auditing teams. The owner or operator
shall either:
    (1) Engage a third-party auditor meeting all of the competency and
independence criteria in paragraph (c) of this section; or
    (2) Assemble an auditing team, led by a third-party auditor meeting
all of the competency and independence criteria in paragraph (c) of
this section. The team may include:
    (i) Other employees of the third-party auditor firm meeting the
independence criteria of paragraph (c)(2) of this section; and
    (ii) Other personnel not employed by the third-party auditor firm,
including facility personnel.
    (c) Third-party auditor qualifications. The owner or operator shall
determine and document that the third-party auditor(s) meet the
following competency and independence requirements:
    (1) Competency requirements. The third-party auditor(s) shall be:
    (i) Knowledgeable with the requirements of this part;
    (ii) Experienced with the stationary source type and processes
being audited and applicable recognized and generally accepted good
engineering practices; and
    (iii) Trained and/or certified in proper auditing techniques.
    (2) Independence requirements. The third-party auditor(s) shall:
    (i) Act impartially when performing all activities under this
section;
    (ii) Receive no financial benefit from the outcome of the audit,
apart from payment for auditing services. For purposes of this
paragraph, retired employees who otherwise satisfy the third-party
auditor independence criteria in this section may qualify as
independent if their sole continuing financial attachments to the owner
or operator are employer-financed or managed retirement and/or health
plans;
    (iii) Ensure that all third-party personnel involved in the audit
sign and date a conflict of interest statement documenting that they
meet the independence criteria of this paragraph (c)(2); and
    (iv) Ensure that all third-party personnel involved in the audit do
not accept future employment with the owner or operator of the
stationary source for a period of at least two years following
submission of the final audit report. For purposes of this requirement,
employment does not include performing or participating in third-party
audits pursuant to Sec.  68.59 or this section.
    (3) The auditor shall have written policies and procedures to
ensure that all personnel comply with the competency and independence
requirements of this section.
    (d) Third-party auditor responsibilities. The owner or operator
shall ensure that the third-party auditor:
    (1) Manages the audit and participates in audit initiation, design,
implementation, and reporting;
    (2) Determines appropriate roles and responsibilities for the audit
team members based on the qualifications of each team member;
    (3) Prepares the audit report and where there is a team, documents
the full audit team's views in the final audit report;
    (4) Certifies the final audit report and its contents as meeting
the requirements of this section; and
    (5) Provides a copy of the audit report to the owner or operator.
    (e) Audit report. The audit report shall:
    (1) Identify all persons participating on the audit team, including
names, titles, employers and/or affiliations, and summaries of
qualifications. For third-party auditors, include information
demonstrating that the competency requirements in paragraph (c)(1) of
this section are met;
    (2) Describe or incorporate by reference the policies and
procedures required under paragraph (c)(3) of this section;
    (3) Document the auditor's evaluation, for each covered process, of
the owner or operator's compliance with the provisions of this subpart
to determine whether the procedures and practices developed by the
owner or operator under this rule are adequate and being followed;
    (4) Document the findings of the audit, including any identified
compliance or performance deficiencies;
    (5) Summarize any significant revisions (if any) between draft and
final versions of the report; and
    (6) Include the following certification, signed and dated by the
third-party auditor or third-party audit team member leading the audit:

    ``I certify that this RMP compliance audit report was prepared
under my direction or supervision in accordance with a system
designed to assure that qualified personnel properly gather and
evaluate the information upon which the audit is based. I further
certify that the audit was conducted and this report was prepared
pursuant to the requirements of subpart D of 40 CFR part 68 and all
other applicable auditing, competency, independence, impartiality,
and conflict of interest standards and protocols. Based on my
personal knowledge and experience, and inquiry of personnel involved
in the audit, the information submitted herein is true, accurate,
and complete.''

    (f) Third-party audit findings--(1) Findings response report. As
soon as possible, but no later than 90 days after receiving the final
audit report, the owner or operator shall determine an

appropriate response to each of the findings in the audit report, and
develop a findings response report that includes:
    (i) A copy of the final audit report;
    (ii) An appropriate response to each of the audit report findings;
    (iii) A schedule for promptly addressing deficiencies; and
    (iv) A certification, signed and dated by a senior corporate
officer, or an official in an equivalent position, of the owner or
operator of the stationary source, stating:

    ``I certify under penalty of law that I have engaged a third
party to perform or lead an audit team to conduct a third-party
audit in accordance with the requirements of 40 CFR 68.80 and that
the attached RMP compliance audit report was received, reviewed, and
responded to under my direction or supervision by qualified
personnel. I further certify that appropriate responses to the
findings have been identified and deficiencies were corrected, or
are being corrected, consistent with the requirements of subpart D
of 40 CFR part 68, as documented herein. Based on my personal
knowledge and experience, or inquiry of personnel involved in
evaluating the report findings and determining appropriate responses
to the findings, the information submitted herein is true, accurate,
and complete. I am aware that there are significant penalties for
making false material statements, representations, or
certifications, including the possibility of fines and imprisonment
for knowing violations.''

    (2) Schedule implementation. The owner or operator shall implement
the schedule to address deficiencies identified in the audit findings
response report in paragraph (f)(1)(iii) of this section and document
the action taken to address each deficiency, along with the date
completed.
    (3) Submission to Board of Directors. The owner or operator shall
immediately provide a copy of each document required under paragraphs
(f)(1) and (2) of this section, when completed, to the owner or
operator's audit committee of the Board of Directors, or other
comparable committee or individual, if applicable.
    (g) Recordkeeping. The owner or operator shall retain at the
stationary source the two most recent final third-party audit reports,
related findings response reports, documentation of actions taken to
address deficiencies, and related records.
0
14. Amend Sec.  68.81 by adding paragraph (h) to read as follows:

Sec.  68.81  Incident investigation.

* * * * *
    (h) The owner or operator shall ensure the following are addressed
when the incident in Sec.  68.81(a) meets the accident history
reporting requirements under Sec.  68.42:
    (1) The report shall be completed within 12 months of the incident,
unless the implementing agency approves, in writing, an extension of
time.
    (2) The report in paragraph (d) of this section shall include
factors that contributed to the incident including the initiating
event, direct and indirect contributing factors, and root causes. Root
causes shall be determined by conducting an analysis for each incident
using a recognized method.
0
15. Revise Sec.  68.83 to read as follows:

Sec.  68.83  Employee participation.

    (a) The owner or operator shall develop a written plan of action
regarding the implementation of the employee participation required by
this section.
    (b) The owner or operator shall consult with employees and their
representatives on the conduct and development of process hazards
analyses, and on the development of the other elements of process
safety management in this rule.
    (c) The owner or operator shall consult with employees and their
representatives on addressing, correcting, resolving, documenting, and
implementing recommendations and findings of process hazard analyses
under Sec.  68.67(e), compliance audits under Sec.  68.79(d), and
incident investigations under Sec.  68.81(e).
    (d) The owner or operator shall provide the following authorities
to employees and their representatives, and document and respond, in
writing within 30 days of the authority being exercised:
    (1) Refuse to perform a task when doing so could reasonably result
in a catastrophic release.
    (2) Recommend to the operator in charge of a unit that an operation
or process be partially or completely shut down, in accordance with
procedures established in Sec.  68.69(a), based on the potential for a
catastrophic release.
    (3) Allow a qualified operator in charge of a unit to partially or
completely shut down an operation or process, in accordance with
procedures established in Sec.  68.69(a), based on the potential for a
catastrophic release.
    (e) The owner or operator shall develop and implement a process to
allow employees and their representatives to anonymously report
unaddressed hazards that could lead to a catastrophic release,
unreported RMP-reportable accidents, or any other noncompliance with
this part.
    (f) The owner or operator shall provide to employees and their
representatives access to process hazard analyses and to all other
information required to be developed under this rule.
0
16. Revise Sec.  68.85 by revising paragraph (b) and adding paragraph
(c) to read as follows:

Sec.  68.85  Hot work permit.

* * * * *
    (b) The permit shall document that the fire prevention and
protection requirements in 29 CFR 1910.252(a) have been implemented
prior to beginning the hot work operations; it shall indicate the
date(s) authorized for hot work; and identify the object on which hot
work is to be performed.
    (c) The permit shall be retained for five years after the
completion of the hot work operations.

Subpart E--Emergency Response

0
17. Amend Sec.  68.90 by revising paragraphs (b)(1) and (3) and adding
paragraph (b)(6) to read as follows:

Sec.  68.90  Applicability.

* * * * *
    (b) * * *
    (1) For stationary sources with any regulated toxic substance held
in a process above the threshold quantity, the stationary source is
included in the community emergency response plan developed under 42
U.S.C. 11003. The community emergency response plan should include the
following components: identification of facilities within the emergency
planning district, identification of routes likely to be used for the
transportation of substances on the list of extremely hazardous
substances, and identification of additional facilities contributing or
subjected to additional risk due to their proximity to facilities, such
as hospitals or natural gas facilities; methods and procedures to be
followed by facility owners and operators and local emergency and
medical personnel to respond to any release of such substances;
designation of a community emergency coordinator and facility emergency
coordinators, who shall make determinations necessary to implement the
plan; procedures providing reliable, effective, and timely notification
by the facility emergency coordinators and the community emergency
coordinator to persons designated in the emergency plan, and to the
public, that a release has occurred; methods for determining the
occurrence of a release, and the area or population likely to be
affected by such release; description of emergency equipment and
facilities in the community and at each facility in the community, and
an identification of the persons responsible for such equipment

and facilities; evacuation plans, including provisions for a
precautionary evacuation and alternative traffic routes; training
programs, including schedules for training of local emergency response
and medical personnel; and methods and schedules for exercising the
emergency plan.
* * * * *
    (3) Appropriate mechanisms are in place to notify emergency
responders when there is a need for a response, including providing
timely data and information detailing the current understanding and
best estimates of the nature of the release.
* * * * *
    (6) The owner or operator maintains and implements, as necessary,
procedures for informing the public and the appropriate Federal, State,
and local emergency response agencies about accidental releases of RMP-
regulated substances and ensure that a community notification system is
in place to warn the public within the area potentially threatened by
the release.
0
18. Amend Sec.  68.95 by revising paragraphs (a)(1)(i) and (c) to read
as follows:

Sec.  68.95  Emergency response program.

    (a) * * *
    (1) * * *
    (i) Procedures for informing the public and the appropriate
Federal, State, and local emergency response agencies about accidental
releases, including assurance that a community notification system is
in place to warn the public within the area threatened by the release;
* * * * *
    (c) The emergency response plan developed under paragraph (a)(1) of
this section shall include providing timely data and information
detailing the current understanding and best estimates of the nature of
the release when a release occurs and be coordinated with the community
emergency response plan developed under 42 U.S.C. 11003. The community
emergency response plan should include identification of facilities
within the emergency planning district, identification of routes likely
to be used for the transportation of substances on the list of
extremely hazardous substances, and identification of additional
facilities contributing or subjected to additional risk due to their
proximity to facilities, such as hospitals or natural gas facilities;
methods and procedures to be followed by facility owners and operators
and local emergency and medical personnel to respond to any release of
such substances; designation of a community emergency coordinator and
facility emergency coordinators, who shall make determinations
necessary to implement the plan; procedures providing reliable,
effective, and timely notification by the facility emergency
coordinators and the community emergency coordinator to persons
designated in the emergency plan, and to the public, that a release has
occurred; methods for determining the occurrence of a release, and the
area or population likely to be affected by such release; description
of emergency equipment and facilities in the community and at each
facility in the community, as well as an identification of the persons
responsible for such equipment and facilities; evacuation plans,
including provisions for a precautionary evacuation and alternative
traffic routes; training programs, including schedules for training of
local emergency response and medical personnel; and methods and
schedules for exercising the emergency plan. Upon request of the LEPC
or emergency response officials, the owner or operator shall promptly
provide to the local emergency response officials information necessary
for developing and implementing the community emergency response plan.
0
19. Amend Sec.  68.96 by revising paragraphs (b)(1)(i) and (b)(3) to
read as follows:

Sec.  68.96  Emergency response exercises.

* * * * *
    (b) * * *
    (1) * * *
    (i) As part of coordination with local emergency response officials
required by Sec.  68.93, the owner or operator shall conduct a field
exercise at least once every 10 years unless the appropriate Federal,
State, and local emergency response agencies agree in writing that such
frequency is impractical. If emergency response agencies so agree, the
owner or operator shall consult with emergency response officials to
establish an alternate appropriate frequency for field exercises.
* * * * *
    (3) Documentation. The owner or operator shall prepare an
evaluation report within 90 days of each field and tabletop exercise.
The report shall include a description of the exercise scenario, names
and organizations of each participant, an evaluation of the exercise
results including lessons learned, recommendations for improvement or
revisions to the emergency response exercise program and emergency
response program, and a schedule to promptly address and resolve
recommendations.
* * * * *

Subpart G--Risk Management Plan

0
20. Amend Sec.  68.160 by adding paragraph (b)(22) to read as follows:

Sec.  68.160  Registration.

* * * * *
    (b) * * *
    (22) Method of communication and location of the notification that
chemical hazard information is available to the public residing within
6 miles of the stationary source, pursuant to Sec.  68.210(d).
0
21. Amend Sec.  68.170 by adding paragraph (e)(7) revising paragraph
(i) to read as follows:

Sec.  68.170  Prevention program/Program 2.

* * * * *
    (e) * * *
    (7) Recommendations declined from natural hazard, power loss, and
siting hazard evaluations and justifications.
* * * * *
    (i) The date of the most recent compliance audit; the expected date
of completion of any changes resulting from the compliance audit and
identification of whether the most recent compliance audit was a third-
party audit, pursuant to Sec. Sec.  68.58 and 68.59; and findings
declined from third-party compliance audits and justifications.
* * * * *
0
22. Amend Sec.  68.175 by adding paragraphs (e)(7) through (9) and
revising paragraph (k) to read as follows:

Sec.  68.175  Prevention program/Program 3.

* * * * *
    (e) * * *
    (7) Inherently safer technology or design measures implemented
since the last PHA, if any, and the technology category (substitution,
minimization, simplification and/or moderation).
    (8) Recommendations declined from natural hazard, power loss, and
siting hazard evaluations and justifications.
    (9) Recommendations declined from safety gaps between codes,
standards, or practices to which the process was designed and
constructed and the most current version of applicable codes,
standards, or practices.
* * * * *
    (k) The date of the most recent compliance audit; the expected date
of completion of any changes resulting from the compliance audit; and
identification of whether the most recent compliance audit was a third-

party audit, pursuant to Sec. Sec.  68.79 and 68.80.
* * * * *

Subpart H--Other Requirements

0
23. Amend Sec.  68.210 by adding paragraphs (d) through (f) to read as
follows:

Sec.  68.210  Availability of information to the public.

* * * * *
    (d) Chemical hazard information. The owner or operator of a
stationary source shall provide, upon request by any member of the
public residing within 6 miles of the stationary source, the following
chemical hazard information for all regulated processes in the language
requested, as applicable:
    (1) Regulated substances information. Names of regulated substances
held in a process;
    (2) Safety Data Sheets (SDSs). SDSs for all regulated substances
located at the facility;
    (3) Accident history information. Provide the five-year accident
history information required to be reported under Sec.  68.42;
    (4) Emergency response program. The following summary information
concerning the stationary source's compliance with Sec.  68.10(f)(3)
and the emergency response provisions of subpart E as applicable:
    (i) Whether the stationary source is a responding stationary source
or a non-responding stationary source;
    (ii) Name and phone number of local emergency response
organizations with which the owner or operator last coordinated
emergency response efforts, pursuant to Sec.  68.180; and
    (iii) For stationary sources subject to Sec.  68.95, procedures for
informing the public and local emergency response agencies about
accidental releases;
    (5) Exercises. A list of scheduled exercises required under Sec.
68.96; and
    (6) LEPC contact information. Include LEPC name, phone number, and
web address as available.
    (e) Notification of availability of information. The owner or
operator shall provide ongoing notification on a company website,
social media platforms, or through other publicly accessible means
that:
    (1) Information specified in paragraph (d) of this section is
available to the public residing within 6 miles of the stationary
source upon request. The notification shall:
    (i) Specify the information elements, identified in paragraph (b)
of this section, that can be requested; and
    (ii) Provide instructions for how to request the information (e.g.,
email, mailing address, and/or telephone or website request);
    (2) Identify where to access information on community preparedness,
if available, including shelter-in-place and evacuation procedures.
    (f) Timeframe to provide requested information. The owner or
operator shall provide the requested information under paragraph (d) of
this section within 45 days of receiving a request.

[FR Doc. 2022-18249 Filed 8-30-22; 8:45 am]
BILLING CODE 6560-50-P