NIH implemented 14 of 15 research security requirements, GAO found

The Government Accountability Office released a report on Friday 16 October 2026. The report found that the National Institutes of Health implemented 14 of the 15 federal research security requirements the agency reviewed. The requirements addressed disclosure, malign foreign talent recruitment programs, research security training and programs, and collaboration and information sharing.

From 2017 through 2025, NIH received 697 allegations of potential foreign interference involving personnel on NIH awards. NIH identified disclosure violations in 264 cases. NIH or recipient institutions took one or more actions in most of those cases, such as prohibiting individuals from participating on awards.

NIH relies heavily on self-reported information disclosed by researchers and institutions. The agency generally does not verify such disclosures using sources outside those required during pre-award risk assessments unless it receives a foreign interference allegation. Additionally, NIH does not require disclosure of all past affiliations, and foreign component disclosures are only required when the collaboration involves the performance of a significant element or segment of the NIH funded project outside of the United States. As a result, NIH may not identify risks when relevant information is not required to be disclosed or is left out.

For the remaining requirement concerning certification by certain recipient institutions that they have established and operate research security programs, NIH is working with an interagency group to implement the requirement. NIH's risk management program is fully aligned with GAO's enterprise risk management practices but not fully aligned with GAO's Fraud Risk Framework. Although NIH's annual risk inventory considers fraud, it is not a documented extramural program specific assessment of fraud schemes, controls, and residual risks.

In fiscal year 2025 alone, NIH awarded about $35 billion in extramural funding. GAO reviewed relevant legal authorities, policies, and NIH documentation. The agency analyzed NIH foreign interference allegation data from 2017 through 2025. GAO compared NIH practices with GAO risk management frameworks. In seven nongeneralizable case studies, GAO used outside sources to identify publicly available information about foreign affiliations and coauthored publications that did not appear in the award documentation.