GAO Report on Research Security, NIH Action Needed to Strengthen Foreign Interference Risk Management
The Government Accountability Office (GAO) reviewed the National Institutes of Health’s (NIH) implementation of federal research security requirements and found that NIH has implemented 14 out of 15 requirements. However, GAO noted that NIH may not identify risks when relevant information is not required to be disclosed or is left out, as it relies heavily on self-reported disclosures from researchers and institutions.
NIH Implements Most Research Security Requirements
The National Institutes of Health (NIH) has implemented 14 out of the 15 federal research security requirements that help protect extramural research from foreign interference. These requirements cover areas like disclosing affiliations, preventing talent recruitment by foreign entities, training researchers, and sharing information about collaborations. NIH works with other agencies to implement one remaining requirement related to certification of research security programs. However, NIH relies mainly on self-reported information from researchers and institutions, which can miss risks if not all relevant past affiliations or collaborations are disclosed.
NIH Foreign Interference Allegations
From 2017 to 2025, the National Institutes of Health (NIH) received 697 allegations of potential foreign interference involving personnel on NIH awards. Out of these, NIH identified 264 cases where there were violations in disclosing information. In most of those cases, NIH or recipient institutions took actions such as prohibiting individuals from participating on awards. GAO conducted seven case studies that showed some limitations to the disclosure-based process used by NIH for identifying foreign interference.
Why GAO Looked Into It
GAO was asked to review NIH’s efforts in safeguarding extramural research from foreign interference and related ethical concerns. This review stems from policymakers’ concern that foreign entities might exploit the openness of federally funded research for national security and economic competitiveness reasons. GAO examined NIH’s implementation of federal research security requirements, its identification and management of foreign interference risks, and aligned these practices with GAO risk management frameworks. The agency reviewed legal authorities, policies, and documentation; analyzed data from 2017 to 2025 on foreign interference allegations; conducted case studies; and interviewed officials to gather insights.
What GAO Recommends
GAO made 1 recommendation to National Institutes of Health:
- The Director of NIH should conduct and document, at regular intervals and in accordance with GAO’s Fraud Risk Framework, a fraud risk assessment tailored to NIH’s extramural research program that considers risks related to foreign interference.
The full report, Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management, is on GAO’s site, publicly released Oct 16, 2026.