Research Security: New NIH Policy Requires Foreign Subrecipients to Share Lab Notebooks and Research Data with the US Prime Awardee

On September 15, 2023, the National Institutes of Health (NIH) moved forward with a controversial new policy requiring foreign subrecipients to provide, at least once per year, copies of lab notebooks, data and documentation that support research outcomes described in a progress report to the prime award recipient. The new policy is in direct response to recent audits conducted by the Department of Health and Human Services, Office of Inspector General (DHHS OIG) and the Government Accountability Office (GAO), each of which raised concerns about NIH’s oversight of funds provided to, among other institutions, the Wuhan Institute of Virology. More generally, the new NIH policy is among the latest salvos in the government’s ongoing efforts to impose stricter security requirements on U.S. taxpayer-funded research.

Key takeaways

• Both the DHHS OIG audit¹ and the GAO audit² raised concerns about NIH’s administration and oversight of its funds passed through to foreign subrecipients and recommended that NIH develop and implement changes to its internal processes to improve oversight of foreign subawards through enhanced monitoring, documentation and reporting requirements.
• Over roughly the past five years, NIH and other major federal research sponsors have developed and implemented a series of research security requirements that are viewed by many in the research community as stifling international collaboration and global engagement. The new NIH policy received substantial criticism from the research community along those very same lines.
• NIH’s new policy, which will go into effect in January 2024, with compliance required by March 2024, will create new administrative hurdles and compliance risks for U.S. research institutions seeking international collaboration.
• Unlike many other research security requirements, the new NIH policy applies broadly to all foreign subawards and is not limited to so-called countries of concern.

The New NIH Policy

NIH effected its new policy through NOT-OD-23-182 “NIH Final Updated Policy Guidance for Subaward/Consortium Written Agreements”³ (the “Policy”). Although NIH notes that the Policy is not intended to undermine its longstanding support for international collaboration, it will impose new administrative barriers and compliance risks that may further contribute to the chilling effect that the government’s ongoing emphasis on research security has had on global engagement activities.

Notably, NIH contends that the Policy is not new. Rather, NIH explains, it is merely a clarification of existing language in the NIH Grants Policy Statement and the Uniform Guidance, which require subawards to include a term allowing the prime awardee and auditors access to a subrecipient’s records and financial documentation. That access to records provision is of course meaningfully different from imposing an affirmative obligation on foreign subawardees to provide information. The tactic of calling a new requirement a clarification is one that NIH and other major federal sponsors have used repeatedly in the research security space, often in an effort to impose new requirements retroactively. Although the risk of retroactive application here is perhaps less than in other research security areas, such as current/pending (or Other Support) disclosure requirements, the consistent efforts to treat new obligations as clarifications has frustrated the research community.

Regardless of whether the Policy is new or a clarification, it amends existing Section 15.2 of the NIH Grants Policy Statement in the following ways:

• Clarifies that “NIH will not support any agreement” that does not meet the NIH Grants Policy Statement requirements governing subawards, including the new requirement to provide access to lab notebooks, data and documentation supporting research outcomes as described in the annual progress report and to do so in alignment with the progress report’s submission (access may be electronic).
• Explains that NIH may request copies of the foreign subawardee’s documentation and that the failure to provide such documentation may lead to enforcement actions.
• Notes that NIH expects prime awardees to have potential subawardees include in their letters of support awareness of the Policy and their willingness to comply with its requirements.
• NIH expects prime awardees to modify existing subawards within 60 days of the Notice implementing the Policy.

Implications of the Policy

First, the Policy will impose a potentially significant administrative burden on prime awardees because they will need to modify existing subawards to address the Policy’s requirements. NIH has recognized that modifying a large number of subawards in a relatively brief period of time may be difficult and has explicitly stated that it will provide more time if needed.⁴ Additional administrative effort may also be required if an existing subrecipient is hesitant to accept the Policy’s requirements. Although not explicit, NIH’s statement that it will not “support” an agreement that does not reflect the Policy suggests that failure to successfully amend a subaward may leave a prime awardee no option but to terminate the subaward and look for a new collaborator. Finding a new collaborator may or may not be achievable and the time necessary to do so may place ongoing research at risk.

Second, and related, institutions will have to solve a new sort of record retention and related organizational challenge. NIH has made clear in its FAQs that it views the material provided by a foreign subrecipient to be squarely within applicable retention requirements. Managing the documentation will, however, be difficult. Because of the now clear obligation to request and receive documentation from all foreign subawardees, requesting the data and tracking their receipt may well be a task better assigned to research administrators than the project team. Yet, it is likely that reviewing the data will be a responsibility of the project team because research administrators are unlikely to have the necessary scientific wherewithal. Thus, there will need to be close coordination between the research administration function and the project team to ensure that the data are requested, collected, reviewed and then retained.

Third, the Policy imposes a potentially significant compliance burden on the prime awardee and perhaps even individual investigators. In its FAQs, NIH addresses the prime recipient’s responsibilities as they relate to data received from a foreign subawardee:

3. What is the prime recipient responsible for once they receive documentation supporting research outcomes from the foreign subrecipient?

Prime recipients should continue to review all subaward documentation to confirm that the performance outcomes that are reported in the Research Performance Progress Report (RPPR) are accurate, complete, and properly reflect programmatic goals, as stated in the RPPR.⁵

At one level, the prime recipient has always been responsible for ensuring the accuracy of progress reports but the Policy arguably creates a higher bar. Now having access to lab notebooks, data and other documentation, the prime awardee is effectively put in the position of having to review that information and ensure that what is reflected in the progress report is accurate and complete. Put another way, going forward, it is going to be substantially more difficult to argue that one did not or could not know of inaccuracies in a progress report. The ramifications of that are potentially significant. Whistleblowers or regulators may assert that a prime institution’s failure to identify problematic content in a progress report was violative of the False Claims Act. At the individual researcher level, query whether the failure to catch falsified or fabricated data in a progress report may provide a basis to make a reviewing investigator a respondent in a research misconduct allegation and, if so, whether the failure to effectively review the progress report constitutes recklessness under research misconduct standards.

Looking Forward

It remains to be seen how burdensome the Policy will be for prime NIH grantees. It is likely that at least for large research institutions the near-term need to modify existing subawards will be challenging. There will also be a need to develop effective business processes focused on obtaining, reviewing and retaining documentation from subawards. There may also be a need to translate large quantities of information. From a compliance standpoint, it will be interesting to see how NIH implements the somewhat vague language in its FAQs that prime awardees are expected to “review all subaward documentation to confirm that the performance outcomes that are reported in the Research Performance Progress Report (RPPR) are accurate, complete, and properly reflect programmatic goals” and whether enforcement activity arises out of a prime awardee’s failure to meet NIH expectations.

^{1 Available here: https://oig.hhs.gov/oas/reports/region5/52100025.pdf.}

^{2 Available here: https://www.gao.gov/products/gao-23-106119.}

^{3 Available here: https://grants.nih.gov/grants/guide/notice-files/NOT-OD-23-182.html.}

^{4 See FAQ #2, available here: https://grants.nih.gov/faqs#/subawards.htm?anchor=56952.}

^{5 Available here: https://grants.nih.gov/faqs#/subawards.htm?anchor=56958.}