Two decades after its last comprehensive revision, the ORI research misconduct policy that governs how US institutions handle allegations against Public Health Service (PHS)-funded researchers has been rewritten. The Department of Health and Human Services’ Office of Research Integrity (ORI) finalised sweeping changes to 42 CFR Part 93 in September 2024, and the compliance clock is now running out for research administrators. For any allegation an institution receives on or after 1 January 2026, the new rule — not the 2005 version still in force today — governs the entire process, from first inquiry to final institutional finding.
For research integrity officers (RIOs), sponsored programmes staff, and institutional counsel, this is not a distant regulatory footnote. It is an operational deadline that requires revised bylaws, retrained committees, and updated PHS assurances before the new year turns. Institutions that received PHS funding any time in the last twenty years will recognise the stakes: 42 CFR Part 93 is the backbone of every federally compliant misconduct policy at universities, medical centres, and research institutes across the country, and non-compliance can jeopardise an institution’s standing to receive further PHS awards.
This piece sets out, in plain language, what changed, when it takes effect, and what research administrators need to have in place before the applicability date arrives.
Why ORI Rewrote Its Research Misconduct Policy
The federal research misconduct regulations at 42 CFR Part 93 had not been substantively updated since 2005. In the intervening years, research practice changed considerably: the 2008 NIH Public Access Policy, the 2023 NIH Data Management and Sharing Policy, the migration of research records to cloud storage, and the emergence of artificial intelligence tools capable of detecting image manipulation and data falsification all outpaced a regulation written for a largely paper-based research environment. ORI’s final rule, published in the Federal Register in September 2024, is the agency’s attempt to modernise federal research misconduct policy for that reality.
Crucially, the amended rule does not retroactively apply to open cases. Institutions must continue to apply the 2005 version of 42 CFR Part 93 to any allegation received before 1 January 2026, unless the respondent and the institution jointly elect in writing to proceed under the new rule instead. This creates a transitional period in which RIOs may be running two parallel sets of procedures — a detail that governance documents and training materials need to reflect clearly.
Revised Inquiry and Investigation Timelines
The most immediately practical change for administrators is timing. Under the current regulation, institutions have 60 days to complete an inquiry and roughly 120 days to complete an investigation once a formal case is opened. The final rule extends both phases: the inquiry period is lengthened to 90 days, and the investigation period to 180 days, giving RIOs and investigation committees materially more runway to conduct a thorough, defensible review before a finding is reached.
The final rule also formalises procedural protections around the investigation report. Respondents must be given an opportunity to review the draft investigation report and to submit written comments — generally within 30 days of receipt — before the institution finalises its findings. Notably, ORI declined to adopt a provision from its proposed rule that would have barred institutions from determining “honest error” at the inquiry stage; that flexibility survives into the final text, giving institutions more room to close weak allegations early without triggering a full investigation.
These extended timelines should be reflected in every institutional misconduct policy, in RIO case-tracking templates, and in any communications sent to complainants and respondents about expected case duration.
Updated Definitions and New Assurance Requirements
The revised PHS research misconduct regulations introduce more than 25 defined terms that did not previously exist in the regulatory text, including “institutional record,” “administrative record,” “intentionally,” and “recklessly.” Institutional record is now explicitly defined as the records an institution actually compiled or generated during a misconduct proceeding — excluding materials it never considered or relied upon — which narrows disputes over what must be produced during appeals or ORI oversight review.
The definition of plagiarism has also been sharpened to explicitly exclude self-plagiarism (text recycling) and authorship disputes from the scope of research misconduct, redirecting those matters to separate institutional processes such as publication ethics review or authorship-contribution reconciliation. This is a useful distinction for institutions that already document individual contributor roles using frameworks such as the CRediT taxonomy — CASRAI originated the CRediT contributor role taxonomy in 2014, and the standard is now stewarded by NISO as ANSI/NISO Z39.104-2022 — since clear contribution records can help RIOs quickly separate a genuine authorship dispute from a fabrication or plagiarism allegation.
On the assurance side, institutions must update their PHS Research Integrity Assurance and supporting policies and procedures to align with the final rule, and reflect that update in the annual report covering 2025 activity, due to ORI on or before 30 April 2026. ORI has also expanded and clarified its jurisdictional reach — the office of research integrity jurisdiction now extends more explicitly to applicants, subawardees, and PHS-supported research regardless of the specific funding mechanism, closing gaps that previously left some collaborative and subcontracted research outside clear oversight.
What This Means for Research Administrators
The practical to-do list for institutions receiving PHS funding is substantial:
- Revise institutional policy documents to reflect the 90-day inquiry and 180-day investigation windows, the new defined terms, and the narrowed plagiarism definition.
- Update the PHS Research Integrity Assurance on file with ORI and prepare to certify compliance in the annual report due by 30 April 2026.
- Train RIOs, deciding officials, and investigation committee members on the revised definitions of intent, recklessness, and institutional record, since these terms carry direct evidentiary consequences.
- Build a transitional protocol for distinguishing cases governed by the 2005 rule from those governed by the 2026 rule, including the joint-election mechanism for respondents who prefer the new procedures.
- Coordinate with sponsored programmes and general counsel on subrecipient and subaward language, given the clarified jurisdictional scope over collaborative research.
- Monitor ORI’s phased guidance releases, which began appearing in December 2025 and are continuing through 2026, for topic-specific implementation detail beyond the regulatory text itself.
Professional associations that support research administrators — including NCURA and ARMA — have flagged the final rule as a priority training topic for 2026, and institutions should expect sample policy language and compliance checklists to continue circulating through those channels and through compliance-focused organisations such as CITI Program.
A Modernised Baseline, Not a Finished Job
The final rule brings 42 CFR Part 93 into closer alignment with how research is actually produced, stored, and scrutinised in 2026 — but it does not settle every open question. Guidance documents are still arriving in phases, institutions are still building parallel procedures for the transitional period, and the practical burden of proof around “intentionally” and “recklessly” will only be tested as new cases move through the revised process. For research administrators, the sensible posture is to treat 1 January 2026 not as a finish line but as the date from which institutional practice will be judged against a materially more detailed, and more demanding, federal standard.
Leave a Reply