EXCLUSIVE: Whistleblower Documents Highlight Serious Safety Concerns for NIH Virus Lab in Montana

Seven months after monkey bit a lab worker, Rocky Mountain Laboratories has failed to figure out a plan to protect federal employees when this happens again. “Must figure out where to go,” read notes.

9 minute read

Internal documents from the National Institutes of Health (NIH) spotlight growing public alarm about safety and the labs that perform dangerous virus studies. Last month, I broke a story that exposed NIH virologist Vincent Munster, who faced an FBI investigation after he was caught bringing back deadly viruses from Africa to his NIH lab in Montana, Rocky Mountain Laboratories. New documents show Rocky Mountain Laboratories (RML) continues to be plagued with safety problems, and NIH executives at the Montana site have yet to fix holes in their safety plan that had been revealed back in November when a monkey bit a worker.

I was given these new NIH documents by a whistleblower who said my May exclusive on Vincent Munster “blew up inside the NIH.”

“They don’t have a real protocol if you’re exposed to something at BSL-4,” the whistleblower told me about the safety practices at RML.

Biosafety Level 4 (BSL-4) is the highest safety protocol in virus research. Its precautions are used when studying the world’s most lethal pathogens—such as Ebola and Crimean-Congo hemorrhagic fever. The NIH has been sent copies of the whistleblower documents for comment, and I will update you with any response.

“They want to do the work at level 4 no matter the cost,” said the whistleblower. “Because they think it’s the most important work on the planet—that must be done, no matter what it takes.”

Earlier this month the Justice Department indicted Munster and one of his lab workers, charging both researchers with two felonies. Munster’s actions exposed a distressing pattern of cowboy conduct by virologists working on deadly viruses. According to the FBI’s criminal complaint Munster was caught at the airport smuggling in viruses. When law enforcement asked him if he had the required paperwork, he replied that he did.

“I do this all the time,” Munster told federal law officials in January. In fact, Munster did not have the required paperwork and has been charged with lying to law enforcement. And Munster’s statement—“I do this all the time”—raises questions of whether smuggling viruses is in fact something he does all the time.

Alarming practices at RML

Munster works at the NIH’s RML in Hamilton, Montana, where he studies maximum containment pathogens, such as Ebola. RML is one of over a dozen labs in the United States that have a BSL-4 facility. The main virology lab has been operated for many decades by Heinz Feldmann, a leading expert on viruses studied under BSL-4 conditions.

Yet emails released by Senator Rand Paul, Republican of Kentucky, raise concerns that practices at RML under Feldmann have long been sloppy. An email chain dating to 2011 finds several virologists—Munster, Feldmann and researchers with EcoHealth Alliance—discussing the logistics of shipping virus samples from Africa to the States. In the final email, EcoHealth Alliance’s Jon Epstein suggests to Feldman and Munster that Munster can hand carry virus samples on a plane after they are put in a viral transport and recovery (VTR) buffer, which keeps them alive.

“I think you can take up to 2kg with you on commercial flights,” emailed EcoHealth Alliance’s Jon Epstein.

In the final week of the Biden Administration, EcoHealth Alliance was debarred from participating in federal programs due to their problematic safety practices. However, the emails released by Senator Paul do not show if these virologists followed through and did in fact transport live viruses on a commercial flight back in 2011.

One email provided by the NIH whistleblower shows that Heinz Feldmann was transferred in August 2025 to run the NIH’s Integrated Research Facility (IRF) in Maryland. A few months prior to transferring Feldmann, the NIH discovered safety violations at the IRF, which Feldmann was apparently sent in to clean up. This included a frightening instance—apparently a lover’s spat—in which a contractor cut holes in an employee’s biocontainment suit designed to protect against infection from viruses such as Ebola.

NIH leadership notified the FBI, which launched an investigation.

Since the NIH put Feldmann in charge of the IRF in Maryland last year to clean up problems at that research site, he has been splitting his schedule between Maryland and Montana. During that time, however, the Montana RML has been found to be plagued with its own safety snafus.

Whistleblower documents

Sometime in November 2025, an RML researcher was exposed to Crimean-Congo hemorrhagic fever “through an accidental breach of personal protective equipment.” The safety incident was never made public, however, until a Montana newspaper reported on it months later in February 2026. “The individual remained well and showed no evidence of being infected,” an NIH spokesperson told the paper in February. “They have been back at work for some time.”

The NIH updated the Montana reporter with more information in May, detailing that the exposure incident was a monkey bite. The NIH also sent the reporter a statement that makes it appear the monkey bite accident was handled in an efficient, by-the-book process, without any hitches, or delays.

Furthermore, details about Providence Hospital in Spokane seem souped-up with government acronyms and biomedical jargon to make the monkey bite patient’s treatment appear extra professional and super sciencey.

Here’s that NIH statement reported in the Montana paper:

“A November 13, 2025 workplace exposure to Crimean-Congo Hemorrhagic Fever Virus (CCHFV) occurred in the Biosafety Level 4 facility at NIH’s Rocky Mountain Laboratories. The worker is highly experienced, wore all required protective gear, and followed all established procedures at the time of the exposure. The employee was immediately decontaminated, isolated and evaluated by experienced clinical experts in coordination with highly trained safety professionals.

“The patient was transferred to the nearest Regional Emerging Special Pathogen Treatment Center (RESPTC) located at Providence Sacred Heart Medical Center & Children’s Hospital in Spokane, Washington.

“Providence is one of 13 Administration for Strategic Preparedness and Response (ASPR)-supported Level 1 RESPTCs, part of the tiered National Special Pathogen System (NSPS) designed to protect patients, communities and the healthcare workforce.

“Established procedures for transport, patient care, waste handling, testing and safety were followed by all involved, from lab staff and agency safety and health support to hospital care team and medical specialists.

“At no time was there any evidence of disease transmission or infection, nor was there ever any risk to staff, caregivers, or the public.”

However, NIH claims in May to the Montana newspaper about the “established procedures” in caring for the monkey bite patient are contradicted by documents provided by the whistleblower.

One document shows that Providence hospital in Spokane, which the NIH lauded in that May statement to the Montana reporter and a week later to reporters with Politico, was never part of the NIH’s plan for patient treatment, which seems to have been managed through improvisation. And notes from a June NIH meeting show the monkey bite patient’s transport—which involved approval from the governors of Montana, Idaho, and Washington—more closely resembled the 1987 road trip comedy film, “Planes, Trains, and Automobiles” than established procedures for a health emergency.

According to NIH documents, the RML staff evaluated and treated the employee on-site after the monkey bite, before sending the patient to St. Patrick’s hospital, about an hour away in Missoula. However, that hospital had staffing problems and could only take the NIH patient for three days. NIH then transferred their employee to Providence hospital in Spokane, Washington. But transportation from Montana to Washington passes through the state of Idaho.

“Had to get the approval of all 3 governors for transport through states via Spokane hospital ambulance.”

When the hospital in Spokane wanted to discharge the patient, who was found to not be sick, NIH disagreed with the hospital and felt the person needed more days of isolation. “What do you do if they become symptomatic, etc.”

NIH then transferred their employee back to RML in Montana, to finish quarantine. “Had to coordinate transport again…with backup RML personnel and emergency personnel. Required intricate communication and used GPS tracking on cell phones for security/arrival time/etc.”

However, isolating their employee at RML required modifyng a room to allow the patient to stay those three days “with bedding, towels, food, entertainment” because the room is evidently not actually designed for quarantine.

“It’s better to call this a triage room, not a quarantine room,” said the whistleblower. “People are not supposed to stay there for days. It’s a triage room.”

RML officials also discovered complications in testing the patient daily to see if they had been infected with Crimean-Congo hemorrhagic fever and were producing viruses. The only lab apparently capable of testing blood samples for the virus is the CDC in Atlanta. This meant catching the only flight out of nearby Missoula to ensure the patient sample made it each day to the CDC.

“Only one FedEX plane leaves Missoula each day so that restricted testing at CDC.”

The NIH’s cheerful, jargon-filled statement to the Montana paper about the critical importance of the Providence hospital in Spokane is also contradicted by the RML’s plan that was in place to handle exposures to dangerous pathogens.

That plan makes no apparent mention of the Providence hospital in Spokane which the NIH told the Montana paper last May “is one of 13 Administration for Strategic Preparedness and Response (ASPR)-supported Level 1 RESPTCs, part of the tiered National Special Pathogen System (NSPS) designed to protect patients, communities and the healthcare workforce.”

But the only hospital that seems to be mentioned in RML’s plan, in place at the time of the November monkey bite incident, is St. Patrick’s in Missoula.

And notes from a June NIH meeting make clear that problems remain at RML, seven months after the November monkey bite incident. The June notes show that any potentially infected worker is now first transported to St. Patrick’s in Missoula “then must figure out where to go from there.”

And while the RML had to convert their triage room last year to allow a three-day quarantine for the monkey bite patient, RML is still trying to figure out how to “modify or build new isolation suite at RML for long term isolation.”

During the November monkey bite accident, the RML realized they couldn’t get daily testing done because there is only one FedEx flight each day from Missoula to the CDC in Atlanta. But to this day they have not figured out another lab that can provide these daily tests to see if an exposed worker has started to produce viruses.

“Also need testing contract for potential RML exposures.”

Other RML problems include how the research facility handles viruses after they arrive, such as the viruses that Munster was caught smuggling into the U.S. According to RML’s current SOP, field samples received at RML will be immediately taken to the restricted access Field Sample room (2B155B). “This lab is dedicated to handling field samples and all employees with access to this lab must be enrolled in the RML Biosafety Program,” reads the SOP.

Once the collected viruses enter the Field Sample room, each sample is then divided into smaller fractions called “aliquots”. An aliquot from each sample is then sent to the Maximum Containment Lab to see if the sample might contain dangerous viruses that should only be handled at BSL-4. Other aliquots from each sample are then inactivated to kill any potentially live viruses, so they can be further analyzed.

However, the whistleblower says this protocol has a gaping hole: the Field Sample room is not secure. “There is no lock on the door, no prox access card,” said the whistleblower. “It’s shared space, and the freezers in there also don’t have locks.”

Finally, an email from Marshall Bloom, a senior RML researcher, discusses a public meeting in June he attended in Hamilton, where he was asked by local officials and members of the public about recent accidents at the RML and the Vincent Munster matter.

RML employees first learned that Munster and his lab researcher had done something wrong earlier this year, said the whistleblower, when NIH police showed up at RML and escorted them both off the RML campus, taking away all their access privileges. They were also required to surrender any government devices.

However, federal employees are prohibited from speaking about ongoing federal investigations, and even the Justice Department generally will not confirm the very existence of an investigation before charges are filed. It was only when my story broke in May that RML researchers learned Munster was being investigated by the FBI after he was caught trying to smuggle in viruses. More details did not become public until June 2, when the Justice Department announced that both Munster and his lab researcher were being charged with felonies.

Yet Marshall told the audience in Hamilton that day that this issue “was now well publicized and working its way through the criminal justice system.” He added, “We demurred providing additional information and repeatedly stressed the presumption of innocence.”

“I don’t know why the presumption of innocence,” the whistleblower said. “Don’t weigh in; don’t say anything. First, we weren’t really told anything about what happened with Munster when it all started, but he set it up like scientists are now trying to circle the wagons.”

Marshall added that, in the public discussion, the audience brought up “biological weapons, Kris Newby’s book Bitten and some more general questions about safety.”

“There’s lots of good science at RML,” said the whistleblower. “But this is a shocking example where they have found problems, and they just kept going on, without any real plan. Hoping no one would get infected. It’s just ridiculous.”

The person added one final note: “A lot of people at RML are really frustrated.”

---

RELATED STORIES