Integrated VPHP: Aseptic Cleanroom Installations Should Close the Regulatory Gap

Ask any contamination control manager about the sporicidal chemistry they use for surface disinfection in aseptic areas—sprays, wipes, rotation schedules—and you’ll get a precise answer: the product name, the EPA registration number, the approved contact time, and where it fits in their cleaning protocol. Using an unregistered surface sporicide would be unthinkable.

Now ask the same person about the hydrogen peroxide chemistry running through their vapor-phase hydrogen peroxide (VPHP)—the one treating entire aseptic rooms—and the answer often becomes less precise. The EPA registration number? Not sure. Was the chemistry tested for use with that specific device? Maybe. Who tested it? The manufacturer, I think?

The difference between these two applications matters. Sprays and wipes touch what the operator touches—a known surface, a known contact time, controlled by a human hand. VPHP reaches everything the air touches—walls, ceilings, behind equipment, inside HEPA housings—controlled by a device. The VPHP step is more demanding. It should carry at least the same regulatory standard, and it does.

Yet in practice, many facilities hold their sprays and wipes to strict EPA registration while accepting one of two problematic situations for their VPHP step:

1. a chemistry that isn’t EPA-registered at all or
2. a chemistry that is registered but not through testing on the specific device being used. (See our blog, “Device + Chemistry: The Regulatory Link Your Fill-Finish Biodecontamination Program Should Understand.”)

In each case, the more demanding step in the contamination control program runs to a lower standard—or no standard at all.

This Isn’t Hypothetical

This gap is not a theoretical concern. It is a pattern playing out across the industry right now.

A growing number of integrated VPHP systems are entering the US market but are not federally approved, without facilities or even original equipment manufacturers (OEMs) understanding the potential consequences. These potentially illegal systems are increasingly bundled into isolators, cleanrooms, material airlocks (MALs), or integrated into whole-room aseptic manufacturing spaces, often without separate regulatory scrutiny. Many come from manufacturers with strong reputations in aseptic equipment engineering. But engineering quality and regulatory compliance are not the same thing.

In many cases, the hydrogen peroxide chemistry running through these systems has never been submitted to EPA for registration—it has not undergone the standardized AOAC-method sporicidal testing that EPA requires for a sporicidal claim. And even when a facility sources a hydrogen peroxide solution that does carry an EPA registration, if that registration was not tested through the paired device, there is still a regulatory gap—the device manufacturer may be unaware they are contributing to this gap.

EPA has backed its position with enforcement. Since 2020, the agency has issued Compliance Advisories specifically addressing devices, including a February 2023 advisory describing a “significant increase” in devices with “substantial non-compliance” with FIFRA requirements. Enforcement actions have included Stop Sale orders, civil penalties reaching $6.9 million, and roughly 60 FIFRA criminal cases in fiscal year 2020 alone.

To our knowledge, only three other vapor- or aerosolized-hydrogen peroxide biodecontamination companies have completed the full EPA registration process—submitting years of efficacy data, independent, third-party GLP testing, AOAC-method soil load studies, and ingredient disclosure, all tied to a specific device and chemistry. When systems enter the market without that chemistry-and-device registration in place, the protection the federal approval is designed to provide is absent—and the regulatory gap falls to the facility.

Validated Is Not the Same as Registered

This is the distinction that trips up well-run programs.

What to Review in Your Own Contamination Control Strategy (CCS)

If you’re not sure whether your VPHP step meets the same registration standard as your surface step, these five questions will tell you:

1. Is the hydrogen peroxide solution in your VPHP system EPA-registered as a sporicide? Not the device—the chemistry. What is the EPA registration number?
2. Was that registration tested through the specific device your facility uses? The registration is tied to the device through which efficacy was demonstrated. If not, it’s not federally compliant.
3. Is the efficacy data from independent, third-party GLP testing? Manufacturer-generated data is not the same as data reviewed and accepted by EPA through the registration process.
4. Can you document the VPHP chemistry as completely as you document your spray or wipe sporicide? Registration number, efficacy data, device compatibility, lot traceability. If the VPHP file is thinner than the spray/wipe file, the gap is visible.
5. Can the manufacturer that you purchased the VPHP system from prove all the steps above to you? A compliant supplier provides this documentation upon request. Difficulty producing it is itself a finding.

These are the same questions you’d ask about any other sporicide before adding it to your CCS. The only difference is that many programs have never applied them to the VPHP step.

And the gap is not just an internal documentation issue. Auditors can see it. We've seen FDA auditors request proof of EPA registration, and EPA can enforce on it—against the manufacturer, the distributor, and the end user. “We bought it from [manufacturer]” is not a compliance defense. If the equipment manufacturer is outside US jurisdiction, the practical burden falls on the US entity operating the system—which is you.

The CURIS Position

CURIS System holds both sides of the contamination control equation to the same standard. CURoxide™, CURIS System’s EPA-registered hydrogen peroxide solution, was tested and registered specifically for use with CURIS® technology. The sporicidal registration was earned through AOAC-method efficacy testing demonstrating 6-log reduction through a tri-part soil load—conducted through the CURIS® device, with independent third-party GLP-testing data review.

That means your VPHP step carries the same EPA registration standard as your manual disinfection. Same rigor. Same independent validation. Same ability to answer an auditor’s questions without hesitation.

If you’re reviewing your CCS and want to close the gap between your surface protocol and your VPHP protocol, contact us. The standard you already follow for sprays and wipes is the same one your VPHP chemistry should meet.

This post addresses general regulatory principles and the current direction of EPA policy and enforcement as of publication. It is not legal advice and does not constitute a formal opinion on any facility’s compliance posture. Facilities seeking a determination on FIFRA applicability or EPA registration requirements should consult regulatory counsel.

FAQ

Q: My spray/wipe sporicide is EPA-registered. Does that registration extend to VPHP if I use the same chemistry?

No. A surface sporicide registration covers the chemistry applied as a spray or wipe at a specified contact time. VPHP—where the chemistry is dispersed through a device—is a different application that requires its own registration approval. The same hydrogen peroxide concentration applied two different ways is two different regulatory questions.

Q: We validate our VPHP cycle with biological indicators. Isn’t that sufficient?

Biological indicator validation confirms your specific cycle works in your specific environment. That’s essential for FDA process validation. But it’s your data, generated in-house. EPA registration means an independent regulatory body has reviewed standardized efficacy data and authorized the chemistry to make microbial (pesticidal) claims. Your BI program validates the cycle; the registration validates the chemistry-and-device pairing. A complete CCS has both.

Q: Our equipment manufacturer says the system is “compliant.” Isn’t that enough?

It depends on what they mean. The equipment may meet engineering, safety, or cGMP standards—but that is separate from whether the hydrogen peroxide chemistry has its own EPA registration tested through that specific device. Ask for the EPA registration number of the chemistry and confirmation that efficacy testing was conducted through the device your facility is using. If they can’t provide both, the system is not compliant in the FIFRA sense.

Q: What is CURoxide™?

CURoxide™ is CURIS System’s EPA-registered hydrogen peroxide solution, developed and tested specifically for use with CURIS^® technology. The sporicidal registration was earned through AOAC-method efficacy testing demonstrating 6-log reduction through a tri-part soil load—conducted through the CURIS® device, with independent, third-party GLP testing. CURIS devices are approved for use in isolators, cleanrooms, MALs, RABS, and numerous other applications.