Medical Event Reporting & 10 CFR 37 Category 1/2 Source Security

Medical Event Criteria under 10 CFR 35.3045

A Medical Event is an unintended radiation exposure during a medical administration of byproduct material or radiation from byproduct material that meets specific dose divergence and delivery failure criteria codified in 10 CFR 35.3045.

Structure of the Medical Event Criteria (10 CFR 35.3045(a))

All administrations except permanent implant brachytherapy, (a)(1). Unless the event results from patient intervention, a medical event occurs when any of three conditions is met:

1. Dose or dosage error, (a)(1)(i): the dose differs from the prescribed dose (or from the dose the prescribed dosage would have given) by more than 0.05 Sv (5 rem) effective dose equivalent, 0.5 Sv (50 rem) to an organ or tissue, or 0.5 Sv (50 rem) shallow dose equivalent to the skin, and one of the following is true:
   • the total dose delivered differs from the prescribed dose by 20% or more;
   • the total dosage delivered differs from the prescribed dosage by 20% or more, or falls outside the prescribed dosage range; or
   • the fractionated dose delivered differs from the prescribed dose for a single fraction by 50% or more.
2. Wrong administration, (a)(1)(ii): a dose that exceeds 0.05 Sv EDE, 0.5 Sv to an organ or tissue, or 0.5 Sv shallow dose from a wrong radioactive drug (or wrong brachytherapy radionuclide), the wrong route, the wrong individual or research subject, the wrong mode of treatment, or a leaking sealed source.
3. Wrong site, (a)(1)(iii): a dose to the skin or an organ or tissue other than the treatment site that exceeds the expected dose by both 0.5 Sv (50 rem) and 50%.

Permanent implant brachytherapy, (a)(2). These criteria use source strength rather than dose, and seeds implanted in the correct site that later migrate are excluded:

• total source strength administered differs by 20% or more from the post-implantation portion of the written directive;
• total source strength administered outside the treatment site exceeds 20% of the documented total; or
• the wrong radionuclide, the wrong individual, sources implanted directly into a location discontiguous from the treatment site, or a leaking source that gives more than 0.5 Sv to an organ or tissue.

Regulatory Nuances & Exclusions

• No dose, no event: A diagnostic dosage given to the wrong patient (for example, $740\text{ MBq}$ of $^{99\text{m}}\text{Tc}$-MDP, well under 0.05 Sv EDE and 0.5 Sv to any organ) does not reach the (a)(1)(ii) dose threshold; it is handled as an internal quality event.
• Patient intervention: Events that result from patient intervention (such as a patient removing an applicator or vomiting a capsule) are excluded from (a). Under 35.3045(b), however, the licensee must still report a patient-intervention event that results, or will result, in unintended permanent functional damage to an organ or physiological system, as determined by a physician.
• Leaking sources: A sealed source counts as leaking at $185\text{ Bq}$ ($0.005\ \mu\text{Ci}$) of removable contamination (35.67); it becomes a medical event only if the dose criteria above are met.
• Embryo/fetus and nursing child (10 CFR 35.3047): An unintended dose greater than $50\text{ mSv}$ ($5\text{ rem}$) to an embryo/fetus from an administration to a pregnant individual (unless the AU approved it in advance), or to a nursing child (or any dose causing unintended permanent functional damage), is reported under 35.3047 rather than 35.3045.

---

Notification Timelines & Reporting Protocols

When a Medical Event is discovered, federal regulations enforce strict notification deadlines tied to the date and time of discovery:

• 24-Hour Telephone Notification (10 CFR 35.3045(c)): The licensee must notify the NRC Operations Center by telephone no later than the next calendar day (within 24 hours) after discovery.
• Referring Physician and Patient Notification (10 CFR 35.3045(e)): The licensee must notify the referring physician and the patient (or responsible relative/guardian) no later than 24 hours after discovery. The licensee need not notify the individual without first consulting the referring physician, and it does not notify the individual if the referring physician personally informs the licensee that he or she will tell the individual, or that, based on medical judgment, telling the individual would be harmful. Appropriate medical care may not be delayed because of notification.
• 15-Day Written Report (10 CFR 35.3045(d)): The licensee must submit a comprehensive written report to the NRC Regional Office within 15 days of discovery. The report details the event description, root cause, estimated patient impact, and corrective actions.

---

10 CFR Part 37: Category 1 & Category 2 Security Thresholds

Title 10 CFR Part 37 establishes mandatory physical protection standards for facilities possessing Category 1 and Category 2 quantities of radioactive material to safeguard against radiological dispersal devices ("dirty bombs").

Radionuclide Activity Thresholds (10 CFR Part 37, Appendix A, Table 1; the TBq values govern)

Sum-of-Fractions Aggregation Rule

Under 10 CFR Part 37, Appendix A, when sources are aggregated (accessible by breaching a single physical barrier), the licensee calculates the sum of fractions:

$\sum_{i=1}^{n} \frac{A_i}{T_i} = \frac{A_1}{T_1} + \frac{A_2}{T_2} + \cdots + \frac{A_n}{T_n} \ge 1.0$

where $A_i$ is source activity and $T_i$ is the threshold. If the ratio $\ge 1.0$, the aggregation triggers Part 37 security controls.

---

Access Authorization & Physical Security Controls

Subpart B: Trustworthiness & Reliability (T&R) Program

Unescorted access to Category 1 or 2 material requires a trustworthiness and reliability (T&R) determination, which only a reviewing official (RO) may make. The licensee names its ROs and certifies each RO's trustworthiness to the NRC under oath, with the RO's fingerprints submitted for an FBI check (37.23(b)). The background investigation (37.25) covers at least the 7 years before the investigation (or since age 18) and includes:

1. Fingerprinting and an FBI identification and criminal history records check.
2. Verification of true identity against official documents.
3. Employment history verification for the most recent 7 years, including military history.
4. Verification of education.
5. Character and reputation determination through reference checks (not with close family members unless no other references exist).

Reinvestigation (fingerprinting and FBI check) is required every 10 years (37.25(c)), and the access authorization program itself must be reviewed at least annually (37.33).

Subpart C: Physical Security Zones & LLEA Coordination

• Security Zones: Radioactive materials must be isolated behind continuous physical barriers (vault walls, locked steel doors) with access restricted to T&R-approved individuals or escorted personnel.
• Monitoring, Detection, and Assessment (37.49): For both categories the licensee must continuously monitor and detect unauthorized entry into the security zone (a monitored intrusion detection system, alarms that alert nearby staff, monitored video, or direct surveillance) and immediately assess each actual or attempted entry. To detect unauthorized removal, Category 1 quantities need immediate detection (alarmed sensors, monitored video, or direct visual surveillance), while Category 2 quantities need weekly verification that the material is still present (physical check, tamper-indicating device, or use).
• Local Law Enforcement Agency (LLEA) Coordination (37.45): Licensees coordinate with the LLEA at least every 12 months (and whenever changes increase vulnerability), describing the facility, the Category 1 and 2 material, and the security measures, and notifying the LLEA that the licensee will request a timely armed response to any actual or attempted theft, sabotage, or diversion. If the LLEA does not respond within 60 days or declines to participate, the licensee notifies the NRC regional office within 3 business days; coordination records are kept for 3 years.

---

Worked Numerical Examples & Clinical Calculations

Example 1: Medical Event Determination (Catheter Displacement)

An HDR $^{192}\text{Ir}$ plan prescribes 5.0 Gy to the vaginal cuff in 1 fraction. An unrecognized 4.0 cm catheter shift delivers only 0.5 Gy to the target while normal rectum receives $8.5\text{ Gy}$ (planned rectal dose was $1.2\text{ Gy}$).

1. Target, (a)(1)(i): The target received $0.5\text{ Gy}$ instead of $5.0\text{ Gy}$, a difference of $4.5\text{ Gy}$ (far above $0.5\text{ Sv}$ to an organ or tissue) and a single-fraction error of $|(0.5 - 5.0)/5.0| \times 100\% = 90\%$ ($\ge 50\%$). This criterion is met.
2. Rectum, (a)(1)(iii): The rectum, a site other than the treatment site, received $8.5\text{ Gy}$ against an expected $1.2\text{ Gy}$: an excess of $7.3\text{ Gy}$ (more than $0.5\text{ Sv}$) and of about $608\%$ (more than $50\%$). This criterion is also met.
3. Conclusion: This is a medical event under 10 CFR 35.3045, requiring a telephone report to the NRC Operations Center by the next calendar day after discovery and a written report within 15 days.

Example 2: Category 2 Source Aggregation During HDR Exchange

An HDR suite contains a spent $^{192}\text{Ir}$ source ($A_{\text{old}} = 388.5\text{ GBq} = 10.5\text{ Ci}$) and a newly delivered replacement source ($A_{\text{new}} = 444.0\text{ GBq} = 12.0\text{ Ci}$) temporarily co-located during exchange. ($T_{^{192}\text{Ir}} = 800\text{ GBq} = 21.6\text{ Ci}$).

$\sum \frac{A_i}{T_i} = \frac{10.5\text{ Ci}}{21.6\text{ Ci}} + \frac{12.0\text{ Ci}}{21.6\text{ Ci}} = 0.486 + 0.556 = 1.042$

Because the sum of fractions $1.042 \ge 1.0$, the co-located sources trigger 10 CFR Part 37 Category 2 security mandates.

---

Comparison Table & Clinical Pitfalls

Clinical Practice Pitfalls

• Discovery Clock vs Event Occurrence: The 24-hour NRC notification clock begins at the time of discovery, not when the event occurred.
• Patient Privacy Violation: Attaching clinical sheets containing patient names to the 15-day NRC report violates 10 CFR 35.3045(d)(2).
• HDR Source Aggregation Oversight: Failing to implement Category 2 security during source exchanges when two co-located sources exceed 21.6 Ci constitutes a security infraction.
• Patient-Intervention Misclassification: Events caused by patient intervention are excluded from 35.3045(a), but 35.3045(b) still requires a report if a physician determines that unintended permanent functional damage results.