HHS ORI Final Rule on Research Misconduct

On September 12, 2024, the Department of Health and Human Services’ (“HHS”) Office of Research Integrity (“ORI”) released a final rule updating 42 CFR Section 93, Public Health Service Policies (“PHS”) on Research Misconduct (“Final Rule”). The research misconduct rule was promulgated almost 20 years ago without subsequent revision, until now. It affects all recipients of Public Health Service funding for biomedical or behavioral research, requiring them to update their policies and procedures governing research misconduct to remain in compliance with the regulation.

HHS first released the research misconduct regulations in 2005. In updating the regulations, ORI cited numerous “policy developments and technological changes applicable to research misconduct, such as the 2008 NIH Public Access policy; the 2023 NIH Data Management and Sharing policy; the shift to saving data on the cloud; and the ability to use artificial intelligence to detect image falsification.” According to an ORI blog post announcing the Final Rule's release, the 2024 version provided, among other updates, "[c]learer assurance, compliance, and research misconduct processes for institutions to follow." 

Below, we summarize some of the differences between the proposed rule and the Final Rule as well as other important changes to the Final Rule.

The effective date of the Final Rule is January 1, 2025, but the Final Rule will not actually apply to institutions until January 1, 2026. Institutions should begin the process of implementing compliance efforts in anticipation of the ORI compliance effective date. 

Final Rule revisions following notice-and-comment period

Following the October 6, 2023 Notice of Proposed Rulemaking, ORI received comments submitted by 123 institutions and 46 individuals. In response to those comments, ORI altered its proposed rule in various ways, including but not limited to:

• Removing the proposed requirement that each PHS funding recipient be responsible for the compliance of their subrecipients and requiring instead that subrecipients file their own assurances with ORI;
• Removing definitions of commonly used terms it had proposed adding (Appeal, Difference of Opinion, Honest Error, Research Integrity, Suspension and Debarment) and clarifying others (Institutional Record, Recklessly, and Small Institution);
• Clarifying and reducing proposed institutional responsibilities in misconduct proceedings, such as:
  • • • Removing lists of potential co-respondents and research records for examination because they were “intended to be exemplary rather than prescriptive;”
      • Removing the requirement to pursue all leads;
      • Simplifying pre-investigation reporting and documentation requirements;
      • Removing the prohibition that institutions not determine honest error during the inquiry stage;
      • Lengthening the institutional inquiry timeline from 60 to 90 days;
      • Clarifying institutional inquiry procedure for additional respondents;
      • Clarifying requirements for the institutional investigation report; and
      • Clarifying the institutional appeal process;

• Ensuring institutional discretion prior to ORI publication of notice of institutional research misconduct proceedings that did not result in ORI findings; and
• Removing the possibility of a limited hearing in the appeals process.

Changes requiring institutional updates on policies and procedures concerning research misconduct

Changes centering on defined terms, applicability, the three-phase process for research misconduct proceedings, and general institutional conduct during those proceedings require that institutions evaluate their current policies and procedures on research misconduct, and potentially revise them to remain in compliance with the Final Rule. The following summary is not all-inclusive, but highlights major changes of which institutions should be aware.

Defined Terms

Intentionally, Knowingly, and Recklessly | Section 93.104(b) of the existing rule on research misconduct required that “misconduct be committed intentionally, knowingly, or recklessly”—but those terms were not defined until the Final Rule. In particular, the definition of “recklessly” may bring further accountability not only to the researchers themselves, but also to their supervisors.

• “Intentionally” is now defined as, “to act with the aim of carrying out the act.”
• “Knowingly” is now defined as, “to act with awareness of the act.”
• “Recklessly” is now defined as, “to propose, perform, or review research, or report research results, with indifference to a known risk of fabrication, falsification, or plagiarism.”

Institutional Record | The Final Rule defines this term for the first time, describing an “institutional record” as being comprised of “records that the institution compiled or generated during the research misconduct proceeding, except records the institution did not consider or rely on” which “include but are not limited to:” documentation of the assessment; the inquiry report and all records relied on or considered during the inquiry; the investigation report and all records relied on or considered during the investigation; any decisions by the Institutional Deciding Officer; the complete appeal record; an index of all records and evidence relied on or considered; and a general description of the records that the institution sequestered but did not rely on or consider.

Applicability

Subrecipients | Under § 93.102(a), the Final Rule clarifies what it means by “institution,” specifying that it applies to “[e]very extramural or intramural institution that applies for or receives PHS support for biomedical or behavioral research, biomedical or behavioral research training, or activities related to that research or research training.” (emphasis added). In other words, ORI explains, “final rule subrecipients are required to have their own assurances filed with ORI.”

Subsequent Use Exception | The Final Rule increases requirements under § 93.104(b), which provides for the regulation’s applicability to research misconduct occurring within six years of the date that an institution received allegations of research misconduct. The Final Rule now provides that the six-year limitation is renewed each time “the respondent uses, republishes, or cites to the portion(s) of the research record that is alleged to have been fabricated, falsified, or plagiarized” in submitted research records. Further, “[f]or research misconduct that appears subject to the subsequent use exception, institutions must document their determination that the subsequent use exception does not apply.”

Three-Phase Process for Research Misconduct Proceedings

(1) Institutional Assessment | As an institution evaluates allegations of research misconduct, it must now document its assessment process, but is not required to write a formal report under § 93.306, as HHS originally proposed in this rulemaking. If an institution subsequently decides to close a research misconduct proceeding, it must retain documentation of its rationale for later review by ORI.

(2) Institutional Inquiry | In determining whether an official investigation is warranted, institutions must now follow increased reporting requirements and time limitations under § 93.307(e). An institution may “convene committees of experts to conduct reviews at the inquiry stage to determine whether an investigation is warranted” or designate another institutional official to conduct the inquiry review with the assistance of subject matter experts. An institution may also conduct interviews of "witnesses or respondents that would provide additional information for the institution’s review."

As for timing, the Final Rule lengthens the institutional inquiry phase from 60 to 90 days. Further, “[i]f the inquiry takes longer than 90 days to complete, the inquiry report must document the reasons for exceeding the 90-day period.” Notably, ORI decided not to prohibit an institution from determining “honest error” at this stage, as its proposed rule had initially set out—leaving more room for flexibility and imposing less burden on respondents and institutions in the Final Rule.

(3) Institutional Investigation | As an investigation proceeds, an institution must ensure it complies with § 93.310. If an institution identifies additional respondents, the institution may (but is not required to) conduct a separate inquiry for each new respondent. An institution must interview “each respondent, complainant, and any other available person who has been reasonably identified as having information regarding any relevant aspects of the investigation, including witnesses identified by the respondent.” An institution must record and transcribe interviews, make that transcription available to the interviewee for correction and available to the respondent (who must not be present during interviews), number exhibits referenced, and “[p]ursue diligently all significant issues and leads discovered that are determined relevant to the investigation, including any evidence of additional instances of possible research misconduct, and continue the investigation to completion.” Finally, an institution must notify respondents in writing of any additional allegations raised against it.

As it did with the institutional inquiry phase, the Final Rule lengthens the timing of the investigation phase from a proposed 120 to 180 days in the Final Rule. If an institution requires an extension, it must request one in writing that details “the circumstances or issues warranting additional time.”

Other changes of note concerning the investigation process include those in § 93.312, which requires that the institution provide respondent an opportunity to review a copy of the draft investigation report and allow respondent to submit comments on the draft report within 30 days of receipt; and § 93.313, which adds various specifications of what must be included in the final investigation report for each respondent, including but not limited to the composition of the investigation committee, inventory of sequestered research records and other evidence relied upon, transcripts of all interviews conducted, identification of documents with the alleged falsified, fabricated, or plagiarized material, and scientific or forensic analyses conducted.

General Conduct

Sequestration | As part of an institution’s general conduct during research misconduct proceedings, § 93.305(a) through (c) describes an institution's responsibility to sequester research records and other evidence, requiring whenever possible the institution to obtain research records or other evidence “before or at the time respondent is notified of the allegation(s); and whenever additional items become known or relevant to the inquiry or investigation.” The institution must provide respondent copies of, or reasonable access, to the sequestered research records, and must also maintain those sequestered research records and other evidence under § 93.318. 

Confidentiality | Section 93.106 restricts institutional disclosure of the identity of respondents, complainants, and witnesses to “those who need to know” but expands that list to include “institutional review boards, journals, editors, publishers, co-authors, and collaborating institutions.” Further, the restriction on disclosure no longer applies “once an institution has made a final determination of research misconduct findings."

Steps to take moving forward

The Final Rule applies to institutions starting on January 1, 2026. Further, ORI has specified that it “will not require institutions to implement and submit revised policies and procedures that comply with the final rule until the submission of their annual report covering 2025, which is due on or before April 30, 2026.” In the interim, it is critical that institutions already receiving or applying for PHS funding for biomedical or behavioral research update their policies and procedures to ensure compliance.

For more information on how the research misconduct Final Rule could impact your institution or for further guidance on how your institution can prepare for compliance, please contact our team.