The Final Rule on Research Misconduct Regulations: What Institutions Need to Know as Implementation Looms

When the current federal administration took office, it issued a memorandum requiring, among other things, that federal agencies delay the issuance of new or proposed rules to the Office of the Federal Register until further review by agency leadership. Because the Final Rule was issued before the change in administration, uncertainty remains regarding how the current administration will address its implementation. Notably, the U.S. Department of Health and Human Services has the discretion to delay the compliance date and/or initiate a new round of notice and comment, with the option to rescind or modify the Final Rule. As of the publication of this Insight, no such action has been taken by the agency. Consequently, institutions should be in the process of revising their current research misconduct-related policies and procedures and planning for compliance with the Final Rule’s new regulatory requirements starting January 1, 2026. Epstein Becker Green is actively monitoring developments in this space.

On September 12, 2024, the Office of Research Integrity (ORI) within the U.S. Department of Health and Human Services (HHS) issued a final rule (“Final Rule”) revising the regulations governing Public Health Service (PHS) Policies on Research Misconduct (42 C.F.R. part 93).[1]

These regulations establish the responsibilities of institutions and ORI in addressing allegations of research misconduct with respect to research supported by PHS funds. In its announcement of the Final Rule, ORI noted the dramatic change in the research landscape over the past 20 years[2] and explained that “[t]echnology, scientific advances, and the globalization of research necessitated an updated regulation.”

As background, on October 5, 2023, ORI issued a Notice of Proposed Rulemaking (NPRM) that proposed revisions to 42 C.F.R. part 93. According to ORI, the comments to the NPRM “generally involved maintaining the balance between ensuring a complete review of misconduct allegations and protecting the rights of respondents and recognizing the potential for administrative burden and cost on institutions.” This feedback from individuals, institutional officials, organizations, institutions, research funding agencies, and other members of the public informed ORI’s drafting of the Final Rule, which notably did not include many of the substantive changes proposed by the NPRM.

In this Insight, we highlight key portions of the Final Rule of particular importance to institutions, including significant deviations from the NPRM and the 2005 version of the regulations (the “2005 Regulation”), and address novel implementation challenges that institutions should be mindful of when updating their research misconduct policies and procedures. Common themes throughout the Final Rule include institutional flexibility, an emphasis on organized documentation, and acknowledgments from ORI regarding future policymaking or guidance documents to assist institutions in implementing the Final Rule.

The Final Rule provides institutions with greater latitude in conducting misconduct proceedings. However, institutions should think critically about how they should update their research misconduct policies to take advantage of these flexibilities and implement them in a way that is consistent across cases and also offers institutions as much protection as possible from potential respondent legal actions.

For your convenience, we have also created (i) a redline highlighting the final changes to the regulations as compared to the 2005 Regulation, (ii) a redline highlighting the final changes to the regulations as compared to the NPRM, and (iii) an “implementation cheat sheet” that gives institutions a quick reference guide for their upcoming preparations ahead of the application date.

Overview of the Final Rule

The regulatory citations included below refer to the citations in the Final Rule.

§ 93.75 Application of effective date to research misconduct proceedings.

• Although the Final Rule’s effective date remained January 1, 2025, ORI clarified that an institution needs to begin following the Final Rule’s new regulatory requirements for allegations it receives on or after January 1, 2026. That said, if an institution receives an allegation of research misconduct prior to January 1, 2026, it may elect to follow the requirements of the Final Rule if the respondent also agrees to that in writing.
  • Implementation Commentary: Although institutions need not submit to ORI their revised policies and procedures until the annual report covering 2025 is due (i.e., on or before April 30, 2026), institutions must have their revised policies and procedures in place as of January 1, 2026.
  • During ORI’s September 20, 2024, webinar on the Final Rule, ORI hinted that it may be issuing further guidance on the application of the Final Rule’s effective date to address lingering implementation questions regarding § 93.75. For example, if an institution applies the 2005 Regulation with respect to an allegation it receives on December 20, 2025, it is unclear which rule the institution should follow if it needs to add another respondent to the matter on January 5, 2026, after it begins implementing the requirements of the Final Rule.
  • Although institutions do not need to begin following the Final Rule until January 1, 2026, they may choose to implement certain clarifications that don’t conflict with the 2005 Regulation prior to that date (e.g., definitions of “intentionally,” “knowingly,” “recklessly,” and “plagiarism”). If an institution wants to apply all or part of the Final Rule prior to January 1, 2026, in a manner that would conflict with the 2005 Regulation, the institution can elect to do that but would first need to obtain the respondent’s written agreement.

Subpart A – General

§ 93.102 Applicability.

• The NPRM included proposed language that would require primary PHS grant recipients to take responsibility for the compliance of their subrecipients. ORI excluded this proposed language from the Final Rule and clarified in the preamble that it “did not intend to impose a new burden on prime funding recipients.” Therefore, according to the Final Rule, subrecipients are required to have their own assurances filed with ORI, as is the case currently.

§ 93.104(b)(1) Time limitations; Subsequent use exception.

• ORI maintained the language that was proposed in the NPRM regarding the application of the subsequent use exception, which is a slightly narrower application than that of the 2005 Regulation. The Final Rule states that the subsequent use exception applies when the respondent “uses, republishes, or cites to the portion(s) of the research record that is alleged to have been fabricated, falsified, or plagiarized” in submitted research records “within six years of when the allegations were received by HHS or an institution.” ORI did note that it may address the application of the subsequent use exception in further guidance.
  • Implementation Commentary: Determining which portion(s) of a research record were used, republished, or cited is likely to be a fact-dependent, extensive process for institutions that will require understanding how specific the reference needs to be to satisfy the “portion” requirement. That said, institutions should think about ways to standardize this process. In addition to documenting when the subsequent use exception does not apply (see the bullet point directly below), institutions should consider appropriately documenting their analysis when it does apply. It also remains unclear whether a citation to an implicated paper in a researcher’s curriculum, grant biographical sketch, or other reference lists will always trigger the subsequent use exception.
  • In light of this, institutions should consider including more detailed explanations in their policies or procedures on how they define the new “portion” requirement.
• Notably, ORI walked back the NPRM requirement of informing ORI of the relevant facts before concluding the subsequent use exception does not apply. According to the Final Rule, in those instances, institutions must simply document the determination appropriately.

§ 93.105(b)(1) Evidentiary standards; Burden of proof.

• ORI restored and updated aspects of this provision that, in the NPRM, it had proposed deleting. The agency concurred with the comments disapproving of this deletion and clarified in the Final Rule that a respondent’s (i) destruction of relevant research records is evidence of research misconduct, if the institution proves, by a preponderance of the evidence (i.e., more likely than not), that the respondent intentionally or knowingly[3] destroyed these records after being informed of the research misconduct allegations, and (ii) failure to provide relevant research records is evidence of research misconduct, if the respondent claims to possess the records but refuses to provide them upon request. ORI explained in the Final Rule’s preamble that these are examples of specific situations in the regulations in which an adverse inference can be made, but this is not a conclusive list. Therefore, if appropriate, institutions could draw similar adverse inferences “under a different set of facts.”
  • Implementation Commentary: Implementing this updated provision will likely generate numerous questions from institutions, including inquiries regarding which different set of facts could draw similar adverse inferences. Furthermore, there is a concern that this provision may encourage respondents to rarely claim that they definitively possess certain records.
  • This provision also clarifies that a respondent’s failure to retain records over time, while potentially violating applicable federal or institutional data retention requirements, is not per se evidence of misconduct and will not be an adverse inference on its own.

§ 93.106 Confidentiality.

• In response to the comments it received, ORI made substantial revisions to the language it proposed in the NPRM with respect to this provision. The Final Rule clarifies that while the proceedings are ongoing, institutions may disclose the identities of respondents, complainants, and witnesses to persons outside the institution if there is a legitimate need (importantly, as determined by the institution itself) for such a third party to know. The Final Rule clearly acknowledges that such third parties may include “institutional review boards, journals, editors, publishers, co-authors, and collaborating institutions.” It also clarifies that once an institution has made a final determination of research misconduct findings, the institution is no longer bound by this confidentiality provision. Finally, the Final Rule explicitly states in subsection (c) that this provision does not prohibit institutions from managing published data and correcting the scientific record.
  • Implementation Commentary: This streamlined provision clarifies institutions’ confidentiality obligations and provides them with greater latitude to decide how to meet these obligations while balancing the need to ensure an accurate scientific record. With respect to subsection (c), it is important for institutions to keep in mind that they can manage the published data and acknowledge that the data is unreliable without necessarily disclosing the identity of the respondents, complainants, or witnesses and without disclosing that the institution is investigating an allegation of misconduct. Determining when, during the proceedings, an institution should begin to think about such management techniques is likely to be case- and fact-dependent.

Subpart B – Definitions

General

• ORI removed the following commonly used terms that were included in the NPRM: “Appeal,” “Difference of Opinion,” “Honest Error,” and “Research Integrity.” According to ORI, these terms did not enhance the clarity of the regulation.

§ 93.200 Accepted practices of the relevant research community.

• ORI retained in large part the proposed definition of “accepted practices of the relevant research community” that was included in the NPRM.
  • Implementation Commentary: Although the inclusion of this definition will likely assist institutions in ensuring better clarity and uniformity in its application to research misconduct proceedings, the reference to “the overarching community of researchers and institutions that apply for and receive PHS grants” remains overly expansive and assumes that there is only one commonly accepted professional code or norm for such a broad and varied population of researchers, scientific disciplines, and institutions.

§ 93.203 Allegation.

• The Final Rule included the same definition of “allegation” that was proposed in the NPRM. This definition clarifies that a disclosure of possible research misconduct should be “brought directly to the attention of an institutional or HHS official” for it to be considered an allegation.
  • Implementation Commentary: This updated definition clarifies that institutions need not consider or proactively seek out online public comments and critiques, such as those on PubPeer, For Better Science, etc., as allegations if they are not provided directly to institutional officials. The Final Rule leaves up to the institutions to determine whether scientific critiques and online chatter brought directly to the institutions’ attention nonetheless constitute “disclosures of possible research misconduct,” as required to move forward as research misconduct.

§ 93.220 Institutional record.

• The Final Rule defines “institutional record” to mean (i) the records that the institution compiled or generated during the proceeding and considered or relied on, (ii) a single index of (i), and (iii) a general description of the records that were sequestered but not considered or relied on by the institution. According to 93.316, “Transmittal of the institutional record to ORI,” after the Institutional Deciding Official has made a final determination of research misconduct findings at the conclusion of an investigation and the conclusion of any institutional appeals, the institution must transmit the institutional record to ORI.
  • Implementation Commentary: The NPRM included a requirement that institutions index all of the institutional record, including those records that the institution did not consider or rely on. Commenters to the NPRM noted the significant institutional burden associated with doing so. Therefore, in its commentary to the Final Rule, ORI explained that it tried to balance its experience (i.e., that the records not considered or relied on could be helpful to the proceedings) with the institutional concerns and settled on the requirement for a general description of these records. ORI noted that it intends to issue guidance on this topic. This change and other documentation requirements throughout the Final Rule (and highlighted herein[4]) emphasize the importance ORI is placing on accurate and organized documentation.

§ 93.227 Plagiarism.

• ORI included a definition of “plagiarism” in the Final Rule that largely tracks the definition proposed in the NPRM and codifies existing ORI guidance. ORI clarifies that plagiarism, a form of research misconduct, “does not include self-plagiarism or authorship or credit disputes.”

§ 93.231 Recklessly.

• In the Final Rule, ORI defines “recklessly” to mean “to propose, perform, or review research, or report research results, with indifference to a known risk of fabrication, falsification, or plagiarism.”
  • Implementation Commentary: The inclusion of an explicit definition for this term is a welcome addition to the regulation. That said, it may still be challenging for institutions and their committees to avoid conflating this definition, which includes the provision “known risk,” with the term “knowingly” (§ 93.223). Further guidance from ORI on where to draw the line between “knowing” and “reckless” would be a helpful tool for institutions.

Subpart C – Responsibilities of Institutions

General conduct of research misconduct proceedings

§ 93.305(a) Sequestration of research records and other evidence.

• The Final Rule expressly permits sequestration of “copies of the data or other evidence so long as those copies are substantially equivalent in evidentiary value.”
  • Implementation Commentary: This provision is a welcome change to institutions as it facilitates the sequestration process, given the electronic nature of many research records today.

§ 93.305(d) Multiple respondents.

• The Final Rule permits institutions to add respondents to an ongoing research misconduct case without conducting a separate inquiry for each new respondent. That said, to avoid infringing on respondents’ due process rights, institutions must provide these respondents with appropriate notice of the allegations and an opportunity to respond. Notably, the Final Rule did not include the proposed requirement in the NPRM that every co-author, co-investigator on funding proposals, collaborator, and lab member must be considered as a potential respondent.
  • Implementation Commentary: This change strikes a balance between reducing the burden on institutions conducting these proceedings, which often evolve and change in terms of scope and potentially responsible individuals, with the important right of respondents to have notice of the concerns to which they are responding.

§ 93.305(e) Multiple institutions.

• The Final Rule largely adopts the same proposal in the NPRM regarding proceedings involving more than one institution. The Final Rule clarifies that when allegations involve research that has been conducted at multiple institutions and a joint research misconduct proceeding is being conducted, one institution must be designated as the lead institution. Furthermore, the lead institution should obtain the research records and other evidence pertinent to the proceeding from the other relevant institutions. ORI intends to issue further guidance on this topic.
  • Implementation Commentary: Given the recent increase in complex misconduct cases involving more than one institution, this new language is a good addition to the regulations. Institutions should pay close attention to ORI’s forthcoming guidance on this topic and think critically about how to address joint research misconduct proceedings in their updated policies and procedures.

Research Misconduct Process

§ 93.306 Institutional assessment.

• The Final Rule formalizes the pre-inquiry assessment phase. The Research Integrity Officer (RIO) or another designated institutional official is required to evaluate, determine, and document whether the allegation (i) falls within the definition of “research misconduct” under Part 93, (ii) is within the jurisdiction of Part 93, and (iii) is sufficiently credible and specific such that potential evidence of research misconduct may be identified. If the requirements for an inquiry are met, the assessment must be documented appropriately and included in the institutional record to ORI. If the requirements for an inquiry are not met, the institution must nevertheless keep a detailed documentation of the assessment to permit ORI to review it at a later time, if necessary. Notably, unlike the NPRM, the Final Rule did not include a time limit for institutions to complete the assessment process.
  • Implementation Commentary: This change codifies prevailing best practices while preserving institutional discretion as to the scope of the assessment phase.

§ 93.307 Institutional inquiry.

• The Final Rule makes it clear that the inquiry may be conducted by a committee of experts, the RIO, or another designated institutional official. Witnesses or respondents may be interviewed at the inquiry stage; however, unlike the language proposed by the NPRM, there is no requirement that such interviews be transcribed. Importantly, the Final Rule does not adopt the NPRM’s proposed requirement that determinations of honest error or difference of opinion be resolved at the investigation stage only. Instead, the Final Rule states that the inquiry report “must note” if there is “potential evidence of honest error or difference of opinion” and gives institutions 90 days to complete the inquiry process (an additional 30 days from the 2005 Regulation); if it takes longer, the inquiry report must include the reasons for the delay.
  • Implementation Commentary: During ORI’s September 20, 2024, webinar on the Final Rule, ORI clarified that institutions may dismiss allegations of research misconduct at the assessment or inquiry stage if there is credible evidence of honest error or difference of opinion.

§ 93.309 Reporting to ORI on the decision to initiate an investigation.

• In the Final Rule, ORI includes additional elements that institutions must include in inquiry reports, which are due to ORI within 30 days of determining that an investigation is warranted. These additional elements are as follows: (i) the composition of the inquiry committee, if used; (ii) an inventory of sequestered research records and other evidence and a description of how sequestration was conducted; (iii) transcripts of any transcribed interviews; (iv) a timeline and procedural history; (v) any scientific or forensic analyses conducted; (vi) the basis on which any allegation(s) do not merit an investigation; and (vii) any institutional actions implemented, including communications with journals or funding agencies.
  • Implementation Commentary: These changes require a larger volume of information to be shared with both ORI and respondents at this stage of the proceedings. However, with the exception of elements (ii) and (vi), the additional requirements largely codify the prior guidance and outlines that ORI issued regarding the contents of inquiry reports.[5] Notably, and unlike the required components of the investigation report, ORI does not exclude from element (ii) the records that the institution did not consider or rely on. Importantly, inquiry reports including all these additional elements must also be shared with respondents, in accordance with § 93.307, and respondents must be provided with an opportunity to review and comment on them. It is worth noting that this is another nod (in addition to the reference in § 93.106(b)) from ORI that journals may be contacted by the institution at the inquiry stage for the purpose of correcting the scientific record.

§ 93.310 Institutional investigation.

• With respect to interviews conducted during the investigation stage, the Final Rule clarifies that these interviews must be recorded and transcribed, and any exhibits shown to the interviewee during the interview must be numbered and referred to by that number in the interview. The Final Rule also clarifies that while the respondents must not be present during the witnesses’ interviews, ORI expects that the respondents must be provided a transcript of the interview.
  • Implementation Commentary: In comments made after the issuance of the Final Rule, ORI stated that these transcripts must be shared with respondents as a matter of due process, but institutions still have the ability to redact transcripts when necessary. The requirement to provide respondents with transcripts of witnesses’ interviews raises a practical question: Should respondents be provided with the transcripts of other respondents in the same matter, or would that be a breach of the institution’s confidentiality obligations under § 93.106? Further guidance from ORI on this implementation question would be helpful.

§ 93.311 Investigation time limits.

• In the Final Rule, institutions are given 180 days (an additional 60 days from the 2005 Regulation) to complete all aspects of an investigation (including preparing a draft investigation report for each respondent for comment). If institutions need additional time to complete the investigation, they must request an extension from ORI in writing and include the circumstances warranting the additional time.

§ 93.313 Investigation report.

• In addition to adopting new requirements for the institutional inquiry report, the Final Rule adds additional elements that institutions must include in their investigation reports. These additional elements include the following: (i) an inventory of sequestered research records and other evidence, except records the institution did not consider or rely on, and a description of how any sequestration was conducted during the investigation; (ii) composition of the investigation committee; (iii) an inventory of sequestered research records and other evidence, except records the institution did not consider or rely on, and a description of how any sequestration was conducted; (iv) transcripts of all interviews conducted; (v) identification of the specific published papers, manuscripts submitted but not accepted for publication, PHS funding applications, progress reports, presentations, posters, or other research records that allegedly contained the falsified, fabricated, or plagiarized material; and (vi) any scientific or forensic analyses conducted.
  • Implementation Commentary: Similarly to § 93.309, other than the new requirement to include an inventory of sequestered records, these additional requirements largely codify the prior guidance and outlines that ORI issued regarding the contents of investigation reports.[6] Notably, ORI carves out of element (iii) the records that the institution did not consider or rely on.

§ 93.316 Transmittal of the institutional record to ORI.

• With slight revisions, the Final Rule incorporates a provision proposed in the NPRM requiring institutions to transmit the institutional record to ORI after the Institutional Deciding Official has made a final determination of research misconduct at the conclusion of the investigation and any institutional appeals. Such institutional record must be consistent with § 93.220 and “logically organized.”
  • Implementation Commentary: If an institution has provided this information as part of its inquiry or investigation report, it is unclear whether the institution would need to reproduce and submit the information again as a complete submission to ORI.

Subpart D – Responsibilities of the U.S. Department of Health and Human Services

§ 93.410 Final HHS action with no settlement or finding of research misconduct.

• In response to many comments, ORI opted not to incorporate a new subsection (b) from the NPRM that would have allowed ORI, in certain circumstances, to publish notice of institutional investigations and actions, but not the names or other identifying information of the respondent(s).

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.

ENDNOTES

[1] The Final Rule was published in the Federal Register on September 17, 2024, at https://www.federalregister.gov/documents/2024/09/17/2024-20814/public-health-service-policies-on-research-misconduct.

[2] In 2005, HHS updated regulations implementing section 493 of the Public Health Service Act (42 U.S.C. 289b), which predated ORI’s establishment. Specifically, HHS removed 42 Code of Federal Regulations (CFR) part 50, subpart A and added 42 CFR part 93, Public Health Service Policies on Research Misconduct.

[3] This is a higher bar than the 2005 Regulation, which references “intentionally, knowingly, or recklessly.”

[4] See, for example, the new documentation requirements in § 93.309 and § 93.313.

[5] See ORI’s “Outline for an Inquiry/Investigation Report for ORI” dated February 21, 2020, at https://ori.hhs.gov/sites/default/files/2020-02/Outline%20for%20Inquiry-Investigation%20Reports%2002-21-2020.pdf.

[6] See id.