ORI Issues Final Changes to Research Misconduct Regulations: Key Reforms and Lingering Complexities

On September 12, 2024, the U.S. Department of Health and Human Services (“HHS”) Office of Research Integrity (“ORI”) issued its highly anticipated final rule (the “Final Rule”) revising the procedures and requirements for research misconduct proceedings at 42 C.F.R. Part 93 (“Part 93”).¹ The Final Rule comes after ORI’s Notice of Proposed Rulemaking (“NPRM”) issued on October 6, 2023 and associated public comment period that produced 171 unique comments submitted by institutions and individuals.² ORI decided to revise Part 93 to address the many policy developments and technological changes that have occurred since its last publication nearly 20 years ago, and to attempt to increase clarity, transparency, and efficiency of process. Part 93, first codified on May 17, 2005, provides the framework for reviewing allegations of research misconduct associated with research supported by U.S. Public Health Service (“PHS”) funds—including funding by the National Institutes of Health.³

The NPRM proposed sweeping changes to Part 93 more extensive than those ultimately adopted as serious stakeholder concerns emerged through the public comment process. This led ORI to walk back several changes that commenters had deemed problematic. For example, the Final Rule did not adopt from the NPRM proposals to (a) require unanimous investigation committee decisions for a finding of research misconduct; (b) require that institutional assessments proceed automatically to inquiry if not completed within 30 days; (c) require ORI to sign off on final decisions as to whether the Subsequent Use Exception requires review of allegations involving older work; (d) require that all determinations of honest error or difference of opinion be resolved only at investigation and not during the earlier inquiry or assessment stages; and (e) permit ORI’s publishing of information about final institutional actions that did not result in settlements or findings of research misconduct.

The effective date for the revised regulation has been delayed to January 1, 2026,⁴ and yet institutional planning for these changes should begin right away. We describe below certain salient changes implemented by the Final Rule, which universities, academic medical centers, and other research institutions should begin considering now. To assist stakeholders with their review, analysis, and implementation of the Final Rule, we also are making available with this alert (i) a detailed chart comparing key provisions of the Final Rule to related provisions under the existing regulations, (ii) a redline comparing the existing regulations to the updated regulations that will take effect pursuant to the Final Rule, and (iii) a redline comparing the version of the regulations proposed under the NPRM to the provisions that will take effect pursuant to the Final Rule.

Important Codifications of Best Practices

The Final Rule memorializes a series of important “best practices” that some institutions have adopted already in various research misconduct cases, but about which the regulations previously were silent or ambiguous.

1. Inquiry and Investigation Processes

Part 93 sets forth a three-part investigational process that consists of (i) an institutional assessment of allegations to determine whether an allegation is “sufficiently credible and specific so that potential evidence of research misconduct may be identified”;⁵ (ii) an “inquiry” that asks the fact-finder to determine whether preliminary fact-finding “indicates that the allegation may have substance” and to prepare an inquiry report;⁶ and (iii) an “investigation” that requires full review of evidence—defined as “any document, tangible item, or testimony offered or obtained during a research misconduct proceeding that tends to prove or disprove the existence of an alleged fact”⁷—and development of an investigation report.⁸

Inquiry. The Final Rule clarifies that a committee is not required to conduct the inquiry; rather, the Research Integrity Officer or another designated institutional official may conduct the inquiry.⁹ While the current regulations do not require institutions to utilize an inquiry committee to conduct the fact-finding at the inquiry stage, use of an inquiry committee (e.g., three unconflicted faculty members at the institution) is the most common approach utilized by academic institutions to conduct inquiries. The clarification in the Final Rule is important to an ongoing discussion by institutions as to how the inquiry process can be improved so that it can advance more rapidly and efficiently. Institutions may consider building upon the momentum in the Final Rule by determining whether the inquiry process should be undertaken by a RIO or other designated institutional official in lieu of a faculty committee, to streamline the process and to conserve faculty time and effort for committee service at the more intensive investigation stage.

Investigation. The Final Rule codifies the ability of institutions to add new respondents and allegations to an ongoing investigation. This permissive authority is implied by the existing regulations, which provide, for example, that institutions must “pursue diligently all significant issues and leads discovered that are determined relevant to the investigation, including any evidence of additional instances of possible research misconduct.”¹⁰ However, respondents sometimes challenge an institution’s decision to expand the scope of an investigation, and new respondents added during the course of an investigation often argue that the institution has failed to comply with federal regulations by not providing the respondent with an opportunity to participate in the inquiry stage. These clarifications will be welcome developments for institutions, as they will allow institutions to evaluate, in each situation in which new allegations or respondents should be added to the scope of an ongoing proceeding, whether a new inquiry should be initiated or whether, instead, efficiency dictates that new allegations and/or respondents should be added to the scope of an ongoing investigation to leverage the expertise and time already expended by an investigation committee.

2. Confidentiality and Disclosure

Part 93 encourages confidentiality in proceedings by requiring that respondent and complainant identities be disclosed only on a need-to-know basis, “to the extent possible,” and as allowed by law.¹¹ Institutions must maintain written research misconduct policies and procedures that protect the confidentiality of respondents, complainants, and research subjects identifiable from research records or evidence.¹²

The Final Rule clarifies that this confidentiality restriction only applies until the institution has made its final determination in the research misconduct process.¹³ The Final Rule provides greater specificity regarding when disclosures of respondent, complainant, and witness identities can be made, stipulating that institutions determine the individuals who “need to know,” and expressly notes that such individuals may include public and private entities, journals, editors, publishers, and officials at other institutions (in the case of receipt of records relevant to allegations under review or the employment of or funding of the research of a respondent found to have committed research misconduct). The Final Rule further specifies that institutions are not prohibited from managing published data or publicly acknowledging that data may be unreliable.¹⁴ These changes provide greater clarity that, for example, RIOs have the authority to communicate with journals during the course of an ongoing research misconduct proceeding about data integrity concerns in published papers.

3. Plagiarism

Part 93 includes “plagiarism” within the definition of research misconduct as “the appropriation of another person’s ideas, processes, results or words without giving appropriate credit.”¹⁵ In longstanding guidance, ORI states authorship disputes (i.e., disputes over which authors are included on a manuscript or the order in which the names are written in the articles) and self-plagiarism are not research misconduct.¹⁶ The Final Rule codifies ORI’s guidance in a revised definition of “plagiarism,” with the revised definition expressly excluding from the definition of “plagiarism” (and therefore excluding from the concept of research misconduct) the “limited use of identical or nearly-identical phrases that describe a commonly-used methodology,” self-plagiarism, and authorship or credit disputes.¹⁷

4. Multiple Institutions Involved in Proceeding

The Final Rule acknowledges that when multiple institutions are involved in a research misconduct proceeding, a single institution should be designated as the “lead institution” if a joint proceeding is conducted. In such cases, the lead institution is responsible for obtaining the research records from other relevant institutions.¹⁸ ORI intends to issue additional guidance on how to handle complex cases involving more than one institution, including how to determine a lead institution.

5. Sequestration

Part 93 requires institutions to sequester “all the research records and evidence needed to conduct the research misconduct proceeding” beginning “on or before the date on which the respondent is notified or the inquiry begins, whichever is earlier.”¹⁹

The Final Rule clarifies that when original research records cannot be obtained, copies of records that are “substantially equivalent in evidentiary value” will fulfill the sequestration requirement.²⁰ The Final Rule also clarifies that sequestration should occur whenever new records become known (in addition to the initial sequestration prior to the respondent being notified of the allegations).

Presently, the investigation report must “identify and summarize the research records and evidence reviewed, and identify any evidence taken into custody but not reviewed.”²¹ Part 93 does not, however, require discussion of sequestration in either the inquiry report or the investigation report. As noted above, the Final Rule also requires that the inquiry and investigation reports include an inventory of sequestered evidence and a description of how sequestration was conducted, except for evidence that the institution did not consider or rely on need not be identified.²² Institutions will need to be mindful of this additional specificity required by ORI and proactive as to the adoption of changes to existing practices, given that the requirements outlined by ORI are more detailed than the existing record-keeping practices of many institutions.

Other Key Changes

1. Interview Transcripts

Part 93 requires that witness, respondent, and complainant interviews conducted at the investigation stage (but not the institutional assessment or inquiry stages) are memorialized in a written recording transcript and requires institutions to provide copies of a recording or transcript to the witness who was interviewed.²³ Part 93 is silent as to whether copies of all transcripts need to be shared with the respondent. The NPRM required that institutions prepare transcripts of interviews at all stages of a research misconduct proceeding and required that such transcripts be shared with the respondent. Commenters suggested that the requirement for transcription and sharing of interviews could discourage reporting of allegations and increase institutional burden. In the Final Rule, ORI removed the transcription requirement at the institutional assessment and inquiry stages but retained the requirement that interviews conducted during the investigation stage should be transcribed.²⁴ Critically, the Final Rule also expressly provides that respondents must be given a copy of all interview transcripts. While this requirement is designed to provide respondents with fair access to the evidence being used by an investigation committee to determine whether research misconduct occurred, it may also disincentivize witnesses from providing candid testimony (or from providing any testimony at all), given the propensity of many witnesses to worry about how a respondent might react to their statements to an investigation committee. For example, respondents who are senior scientists may be in a position to influence the careers of key witnesses who are more junior scientists. ORI, however, did not specify that transcripts must be provided to respondents in an unredacted and/or non-anonymized fashion, leaving institutions to decide on a case-by-case basis whether redactions or anonymizing of transcripts may be appropriate to protect witnesses.

2. Respondent Record Retention

Part 93 currently states that a respondent’s failure to provide research records adequately documenting the questioned research is evidence of research misconduct where the institution or HHS establishes by a preponderance of the evidence that the respondent destroyed the records, failed to maintain them, or failed to produce them in a timely manner.²⁵ The Final Rule permits such a conclusion only if the respondent claims to possess the records but refuses to provide them upon request,²⁶ thereby removing an important express mechanism for institutions to weigh poor record-keeping practices as part of the evidence used in determining whether a respondent committed research misconduct. We believe that this is a change in the regulations that will plague the research misconduct process in significant ways because it will allow respondents simply to deny that they have any relevant research records, and to do so with impunity.

3. Institutional Records

Part 93 currently requires the institution to file the investigation report with ORI at the conclusion of an investigation.²⁷ Institutions typically submit investigation reports and accompanying exhibits to the reports, with the exhibits comprising the key evidence relied upon by the investigation committee. The Final Rule modifies the ORI reporting requirement to include the entire institutional record, which includes documentation of the assessment; the inquiry report and all records considered or relied on during the inquiry; the investigation report and all records considered or relied on during the investigation; all transcripts; decisions by the Institutional Deciding Official; records of any appeals; an index listing all the research records and evidence that the institution compiled during the research misconduct proceeding; and a general description of the records that were sequestered but not considered or relied on.²⁸ While institutions have been required to maintain these records as part of a research misconduct proceeding, they have not been required to maintain all records in a uniform fashion or to provide the entire record set to ORI. Under the Final Rule, institutions will now be required to transmit such records to ORI, which will require many institutions to enhance the level of detail and rigor in their labeling, organization, and record-keeping associated within information gathered throughout the course of a research misconduct proceeding.

Note that there is a carveout from the requirement to provide the entire record set to ORI. Specifically, the Final Rule provides that the definition of “institutional record” excludes “records the institution did not consider or rely on.” Therefore, institutions can elect not to provide certain information to ORI, but only if the institution can affirmatively determine that the information at issue was something that was not considered at the assessment, inquiry, or investigation stage.

4. Definitions of Intentionally, Knowingly, and Recklessly

Part 93 currently stipulates that a finding of research misconduct requires that the misconduct be committed intentionally, knowingly, or recklessly, but does not define these terms.²⁹ The Final Rule defines “Intentionally” as “to act with the aim of carrying out the act,” “Knowingly” as “to act with awareness of the act,” and “Recklessly” as “to act recklessly means to propose, perform, or review research, or report research results, with indifference to a known risk of fabrication, falsification, or plagiarism.”³⁰ ORI notes that it intends to explore in future rulemaking opportunities to harmonize the definition of “intentionally” across federal entities.

5. Subsequent Use Exception

Part 93 generally applies to research misconduct that occurred within six years of the date that an institution received the allegations of research misconduct.³¹ However, any citation to, republication of, or “other use for the potential benefit of the respondent” of a research record that is the subject of research misconduct allegations renews the six-year limitation. This renewal of the six-year limitation is known as the “Subsequent Use Exception.”³² In practice, this means that allegations pertaining to work published outside of the six-year limitations period must be reviewed pursuant to the research misconduct process if the respondent has cited to that publication in a subsequent paper published within six years prior to receipt of the allegations. Historically, ORI representatives have interpreted the Subsequent Use Exception quite broadly and, on occasion, have suggested that even inclusion of a paper in a curriculum vitae or grant biosketch could trigger the Subsequent Use Exception. The determination of whether the Subsequent Use Exception applies is made by the institution at the institutional assessment stage, prior to allegations proceeding to inquiry.

The Final Rule modifies the Subsequent Use Exception to apply only to the respondent’s use, republication, or citation to “the portion(s) of the research record that is alleged to have been fabricated, falsified, or plagiarized.”³³ In practice, it may be difficult in many cases for institutions to determine when a “portion” of a research record has been cited because citations in a scientific publication do not typically reference a particular figure or portion of the cited publication. The application of the Subsequent Use Exception under the Final Rule is therefore ripe for additional guidance from ORI and for extended discussions among the regulated community, given the lack of clarity as to how the admittedly narrower exception under the Final Rule should be applied.

6. Finality of Institutional Decisions

Part 93 implies, but does not state expressly, that an institution’s determination of whether research misconduct occurred is independent of any finding from ORI regarding research misconduct. As Ropes & Gray authors noted in a 2016 article,³⁴ Part 93’s failure to expressly state this has led to confusion among institutions and some arguments from respondents that a finding from ORI is required before a finding of research misconduct can be final. The Final Rule codifies that ORI findings are not required for institutional decisions regarding research misconduct to be considered final or to warrant “remediation under the institution’s policy.”³⁵

---

There likely are to be many updates from ORI and conversations among the regulated research community about the implementation of the Final Rule between now and the January 1, 2026 effective date. We will continue to monitor developments relating to the Final Rule. For additional information, please contact one of the authors or your usual Ropes & Gray advisor.