On September 17, 2024, the Office of Research Integrity (ORI) in the U.S. Department of Health and Human Services published a long-awaited revision of the Public Health Service (PHS) Policies on Research Misconduct (42 CFR 93 in the Code of Federal Regulations). The new rule modernizes the federal framework that governs how institutions handle allegations of fabrication, falsification, and plagiarism in PHS-funded research.
It is the first major update since 2005 and is broad in its reach, to say the least. For universities, academic medical centers, and other research institutions, this is a pivotal moment to reassess compliance systems, research-integrity culture, and procedural readiness. Although the rule took effect January 1, 2025, institutions must apply it to any allegations received on or after January 1, 2026, with updated institutional assurances due by April 30, 2026.
What follows is a walkthrough of the key highlights of the rule, analysis for institutional stakeholders, and actionable recommendations to prepare.
Regulatory Breakdown of ORI’s 2024 Rule
Clarified Definitions of Intent and Culpability
The Final Rule now defines “intentionally,” “knowingly,” and “recklessly,” refining the standard for finding research misconduct. This helps align institutional determinations with ORI’s evidentiary expectations while demanding greater care in documenting how intent is established.
Separate Applicability and Transition Dates
The effective date (January 1, 2025) and the applicability date (January 1, 2026) are distinct. Allegations received before the applicability date continue under the 2005 rule unless both the institution and respondent agree in writing to use the new one. Institutions must submit their revised misconduct-assurance policies to ORI by April 30, 2026.
Procedural Flexibility and Institutional Recordkeeping
Institutions now have greater discretion in structuring inquiries and investigations, including how new allegations or respondents are added. However, the rule tightens expectations for compiling and maintaining the complete institutional record, which must include assessment notes, inquiry and investigation reports, transcripts, and appeal documents.
Clarified Statute of Limitations and Subsequent-Use Exception
The six-year limitation remains, but if tainted research is cited or reused within that period, misconduct proceedings can be reopened. Institutions must monitor publications and grant submissions that may re-surface questionable data.
Confidentiality and Communication
The Final Rule clarifies who may have a “need to know” the identity of respondents and witnesses, permitting disclosure to journals, collaborators, or publishers when warranted. It should be noted that permitting disclosure to journals is not required. Institutions may also notify journals that published data may be unreliable.
Subrecipient Assurances
The rule confirms that subrecipients must maintain their own ORI assurances; prime recipients are not newly burdened with oversight of those processes but must verify compliance through agreements.
Extensive New ORI Guidance Suite
ORI released a robust set of supporting documents:
The primary goal of these guidance documents is to empower institutions to build compliant systems and strengthen integrity culture.
Why This Should Matter to Research Institutions
For complex, multidisciplinary environments like research institutions, the rule carries practical and cultural implications:
- Governance renewal: Institutions must reinforce their research integrity office structure and clarify the authority of Research Integrity Officers (RIOs), committees, and deciding officials.
- Training and credentialing: A 2025 article in Accountability in Research found that structured training improved self-efficacy for committee members handling misconduct cases but revealed wide gaps in institutional preparedness. Institutional leadership should invest in specialized training on misconduct procedures, not just Responsible Conduct of Research (RCR).
- Collaborative research complexity: With multisite trials, joint appointments, and shared data repositories, policies must define responsibility for evidence sequestration, interviews, and final determinations.
- Digital recordkeeping: With research data stored in the cloud or artificial intelligence–enhanced repositories, institutions must define how to secure and authenticate substantially equivalent copies during investigations.
- Transparency and trust: Institutions should balance confidentiality with the duty to correct the record and protect future research participants.
Actionable Steps to Institutional Compliance with the ORI 2024 Rule
Conduct a Gap Analysis
Compare your current policy against the 2024 Final Rule and ORI’s implementation guidance. Map differences in definitions, timelines, procedures, confidentiality, and records management. Set a clear internal schedule for updates before the 2026 applicability date.
Revise Policies and Procedures
Leverage ORI’s Sample Policies and Procedures and Writing Policies and Procedures Guidance as templates. Ensure your institutional documents clearly cover:
- Definitions of intent and culpability
- Assessment, inquiry, and investigation stages
- Sequestration of records and maintenance of the institutional record
- Multi-institution coordination and subawardee responsibilities
- Conditions for disclosure to journals or collaborators
Update Training and Governance Structures
Provide role-specific training for RIOs, committee members, and department chairs. Integrate misconduct-process modules into your RCR curriculum. Consider mock investigations or tabletop exercises to test readiness and clarify expectations. Confirm that committees have clear conflict of interest safeguards.
Strengthen Documentation Systems
Modernize your record-management platform to capture assessment logs, inquiry and investigation timelines, interview transcripts, and final determinations.
Foster Communication and Culture
Announce the policy revision effort across the institution. Frame the Final Rule as an opportunity to reaffirm research integrity and transparency rather than as a purely regulatory exercise.
Monitor Ongoing Guidance and Engage Key Stakeholders
Collaborate with general counsel, research administration, and compliance office offices to ensure consistent policies. Smaller institutions should consult ORI’s Small Institution Guidance for scaled approaches.
Closing Thoughts
The 2024 ORI Final Rule represents more than a regulatory update. The modernization emphasizes accountability, clarity, and flexibility while reaffirming institutions’ central role in maintaining public trust.
For research institutions, the path forward is clear:
- Start now on your gap analysis and policy revisions.
- Engage legal counsel and research leadership to apply policies consistently.
- Educate your research community on the new definitions and expectations.
- Submit compliant assurances by the April 30, 2026, deadline.
As clinical research and compliance professionals, we are stewards of both participant protection and scientific credibility. The ORI rule gives us the tools and a significant responsibility to strengthen that stewardship.
Now is the time to act.
Build the structures, train your people, and embody the culture of integrity that this new era demands.
Submitted by Tasha Mohseni from RD Research Services LLC
