Report on Research Compliance 21, no. 10 (October, 2024)
Now that the HHS Office for Research Integrity (ORI) has published its final rule revising 2005 regulations governing misconduct, compliance officials could be engaging in three activities simultaneously: checking to see if ORI dropped sections of the October 2023 proposed rule they considered most onerous; reviewing new provisions that will affect how they function; and determining which, if any, they want to implement before the required date of Jan. 1, 2026.
Judging by recent questions posed during two webinars (one offered by ORI), they’re also extremely eager for ORI to make good on its promise of issuing, in ORI’s words, “checklists, self-assessments and flow charts,” as well as sample policies and procedures that comply with the new regulation. Published Sept. 17, the rule spells out requirements for how institutions investigate fabrication, falsification and plagiarism alleged to occur “in proposing, performing, or reviewing research, or in reporting research results” when there is Public Health Service support and that “does not include honest error or differences of opinion.”[1]
Barbara Bierer, whose titles include faculty director of the Multi-Regional Clinical Trials Center (MRCT) of Brigham and Women’s Hospital and Harvard, said ORI “appears to have listened very carefully, have thought very carefully about the revisions to the final rule.” Speaking during a Sept. 19 webinar hosted by the law firm Ropes & Gray, Bierer called the final rule a “credit” to both ORI and the “responsiveness of the regulated community” in offering detailed comments on the notice of proposed rulemaking (NPRM).
A day later, ORI Director Sheila Garrity—hosting a webinar she said had 1,000 attendees but which the agency said it had no plans to post online—also praised commenters. “Everyone here is part of this final rule, and you need to understand that this is rulemaking at its best. You commented, and we heard you,” she said.
Garrity became ORI director in March 2023, with the NPRM published seven months later, following a request for information (RFI) ORI issued in September 2022 to help understand areas of the nearly 20-year-old regulation that should be updated. The RFI elicited 31 comments—“not a lot,” according to Garrity, who suggested the RFI might have lacked “clarity.” ORI wrote the NPRM based on the RFI responses and its “experience since 2005 when the current regulation went into effect,” she said during the webinar.
In a separate interview with RRC, Garrity likened the agency’s approach to writing the NPRM as “let’s throw the kitchen sink and see what’s needed here.” She also highlighted significant changes from the 2005 rule, including what she termed during the webinar to be a “dramatic” change related to judicial review of ORI findings.[2]
The most common topics and major themes NPRM commenters addressed were increased administrative burdens; changes to confidentiality and whistleblower protections; new and/or revised definitions; provisions related to ORI publishing institutional findings; and requests for more time to implement the new rule, Garrity explained.
In fact, a number of commenters, including from the University of Pennsylvania, requested that ORI withdraw the NPRM entirely and start over.[3] Although agency officials didn’t do that, they removed seven proposed changes “after significant criticism” and revised four others; these 11 changes were highlighted in Ropes & Gray’s webinar.
As Ropes & Gray Counsel Minal Caron put it: “In almost all of those cases, they walked back or withdrew” the portions of the proposed rule that commenters found to be “just too burdensome, or too different, difficult or too cumbersome to implement.”
This article provides an overview of the final rule, with details on substantive changes from the proposed and 2005 rules. Future stories will delve into specific provisions, including changes to how “honest errors” are treated and address new definitions, among other topics.
During the webinar, Ropes & Gray partner and MRCT Co-director Mark Barnes noted that some of the changes are likely to be welcomed by accused scientists as well as by their institutions. “For example, having the [research integrity officer] be able to do the inquiry with expert assistance may speed the process, and that would be very good for many respondents,” Barnes said.
Yet, as Bierer pointed out, “for every decision, there’s unintended consequences that we’re going to have to work through.”
Changes From the NPRM
As described by the firm, ORI omitted:
-
Applicability: “Funding recipients are responsible for the compliance of their subrecipients” with the misconduct regulation.
-
General Conduct of Research Misconduct Proceedings: “Institutions must consider all additional possible responsible parties including principal investigator, collaborators, and lab members as potential respondents.”
-
Investigation Report: “Voting or split decisions by the investigation committee members are not permitted in the final recommendation in the investigation report.”
-
Final HHS Action with No Settlement or Finding of Research Misconduct: “HHS may publish institutional research misconduct findings and institutional actions even when an HHS action does not result in a settlement or finding of research misconduct.”
Also omitted were the following changes proposed for institutional inquiries:
-
“Assessment stage automatically proceeds to inquiry if assessment is not completed within 30 days.”
-
“A determination of honest error or difference of opinion must not be made at the inquiry stage; it must be made in the investigation stage, if at all.”
-
“Institutions must request an extension from ORI if the inquiry exceeds 60 days.”
Meanwhile, as described by Ropes & Gray, ORI revised the following:
-
§ 93.104 Time Limitations: The proposed rule said, “ORI, not institutions, makes the final determination of whether the subsequent use exception to the six-year statute of limitations applies.” Under the final rule, institutions must “document their determination,” but there is no new “mechanism whereby ORI would review and approve the institutional determination.”
-
§ 93.106 Confidentiality: “Institutions must inform respondents, complainants, and witnesses prior to interview if and how their identity may be disclosed.” This was revised to specify that the “limitation on disclosure of identities no longer applies after an institution has made a final determination.”
-
§ 93.305 General Conduct: “All interviews must be transcribed,” as stated in the proposed rule, was revised to specify that “all interviews in investigation stage must be transcribed and all transcribed interviews at any stage must be shared with [the] respondent.”
-
§ 93.306 Institutional Assessment: The proposed rule called for a “new formalized assessment stage include[ing] a requirement to produce an assessment report with extensive mandatory content.” The final rule offers a "more flexible requirement to ‘[d]ocument the assessment.’"
Longer Time for Inquiry, Investigation
For organizations that must comply with the new regulation, perhaps the first important point is to recognize that they have time to digest the changes and adjust policies and procedures, as ORI has set Jan. 1 as the “effective” date. A year later is the “applicable date.” The third date to keep in mind is April 30, 2026.
As the rule explains, “ORI retained the proposed effective date of January 1, 2025, but clarified that all regulatory requirements are applicable on or after January 1, 2026, in order to provide ample time for institutions to prepare for the final rule. ORI will not require institutions to implement and submit revised policies and procedures that comply with the final rule until the submission of their annual report covering 2025, which is due on or before April 30, 2026.”
Other dates and time frames in the final rule include a 90-day time frame to complete an inquiry, a month longer than the 2005 requirement. “If the inquiry takes longer than 90 days to complete, the inquiry report must document the reasons for exceeding the 90-day period,” according to the rule. A related change is new authority for a designated institutional official to conduct an inquiry, in addition to establishing a committee to undertake this task. Barnes said this has become common practice and was not prohibited by the 2005 regulation but is now officially permitted.
Additionally, ORI extended from 120 to 180 days for “all aspects” of the investigation to be completed. As of now, institutions may request an extension of time but must, in a change, explain “the circumstances or issues warranting additional time.” Barnes said the additional two months was “nice” but said that, “in a complex case, there is almost no way that that 180 days will suffice to cover what needs to be covered and to convene the committee and the respondents and get the testimony and write a report and do the expert analysis and everything else.”
Specific Freedom to Warn Journals, Others
The change regarding confidentiality is “incredibly positive,” according to Barnes.
Specifically, the final rule states that “disclosure of the identity of respondents, complainants, and witnesses while conducting the research misconduct proceedings is limited, to the extent possible, to those who need to know,” a group that “may include institutional review boards, journals, editors, publishers, co-authors, and collaborating institutions.” Barnes added that this will also apply to institutional animal care and use committees.
Barnes said that he and Bierer believe that academic and scientific institutions have a “mission-driven obligation, an ethical obligation” to sound the alarm “when they know that there is a problem with a...scientific presentation or publication, regardless of the cause of it, regardless of whether anybody’s guilty of misconduct or not.”
“It’s extremely important that the publisher, the journal editor…whatever is the platform for the presentation, be alerted” to data irregularities or problems with reliability, he said.
During ORI’s webinar, Garrity said the list of entities that can be informed during an investigation is not exhaustive and could include “different offices in the university.” She added that “universities know best who needs to know.” Garrity also pointed out that no disclosure prohibitions apply once the institution makes a finding of misconduct and that the relevant identities must be provided to ORI.
Bierer said she “wanted to reemphasize” that the names of accused scientists or complainants don’t need to be disclosed when, prior to a finding, a journal is informed that a notice of concern or a correction may be warranted, for example. An investigation report “can take a long time to finalize, and people should not be doing research depending on that data without being alert to” known concerns, she said.
Implementation Questions Remain
When asked by an audience member for a timeline on agency guidance or other resources for implementing the new rule, Garrity said during ORI’s webinar that these “will be available before the end of the year,” adding that a checklist for organizations to use to evaluate their policies and procedures compared to the changes “should be available in the next few weeks.”
Garrity also received a number of questions about how soon institutions could begin following the new rule. She said the new rule could not be implemented in a piecemeal fashion. For example, “you can’t just use the definitions from the 2024 rule; you would have to use the whole rule, and you would have to have a written agreement with the respondent that says, ‘for this case, we’re going to use this rule,’” Garrity said.
However, in response to a questioner who asked, “to the extent the final rule clarifies aspects of the current rule, can institutions take advantage of that?” Garrity said, “That makes perfect sense to me.”
But, due to the nuances associated with the effective and applicable dates of the new rule, Garrity said she would “get a straightforward answer and post it on our website.”
1 Public Health Service Policies on Research Misconduct, 89 Fed. Reg. 76,280 (Sept. 17, 2024), https://bit.ly/4gNKzH1.
2 Theresa Defino, “Penn Calls for Withdrawal of ORI’s Misconduct Proposed Reg; Many Commenters Also Critical,” Report on Research Compliance 21, no. 3 (March 2024), https://bit.ly/3IB2bWC.
3 Theresa Defino, “ORI’s Garrity: Final Rule ‘Walks Delicate Line,’” Report on Research Compliance 21, no. 10 (October 2024).
[View source.]
