On September 15, 2023, the National Institutes of Health (NIH) issued Final Updated Policy Guidance for Subaward/Consortium Written Agreements, requiring foreign subrecipients to provide access to all lab books, all data, and all documentation that supports the research outcomes as described in the progress report.
Despite objections from the research community, the final guidance contains few changes from the Notice that NIH published in the Federal Register last June.
On September 15, 2023, NIH published Final Updated Policy Guidance for Subaward/Consortium Written Agreements (see Notice NOT-OD-23-182). The final guidance, issued in response to Department of Health and Human Services (HHS) Office of Inspector General (OIG) and Government Accountability Office (GAO) audits, focuses on the regulatory requirement that requires subaward agreements to include a requirement that the subrecipient “permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part.” 2 C.F.R. 200.332(a)(5). As NIH notes in the final guidance, in order to comply with the rule NIH “finds it necessary” to require foreign recipients to disclose records to the primary recipient at an agreed-upon frequency.
Policy Requirements
Although NIH stresses that “this is not new policy,” it nonetheless made updates to the NIH Grants Policy Statement Section 15.2 to clarify the requirement (note that prior to the effective date of January 1, 2024, the new language should be accessed through Notice NOT-OD-23-182). The final guidance, in addition to revisions to Section 15.2, makes clear that recipients must:
Ask potential subrecipients, at the application stage, to submit language in their letters of support indicating that they are aware of and are willing to follow all requirements if they receive an award;
Enter into a formal, written agreement, signed and agreed to by both parties, addressing the negotiated arrangements for meeting the requirements of the grant (note that if a subrecipient is unwilling to accept the requirements then an agreement cannot be issued);
When providing awards to foreign subrecipients, include in the agreement a provision requiring the foreign subrecipient to provide access—which may be entirely electronic— to copies of all lab notebooks, all data, and all documentation that supports the research outcomes as described in the progress report, to the primary recipient with a frequency of no less than once per year, in alignment with the timing requirements for Research Performance Progress Report submission; and
Be prepared to submit copies of the written agreement and supporting documentation to NIH as part of NIH’s oversight responsibilities.
NIH stressed that it revised the new language in Section 15.2 (in bold, above) in response to public comments. While NIH’s originally proposed language used the term “provide copies,” the new, final language instead uses the term “provide access, and adds that the access may be entirely electronic. NIH explained this change, stating that “‘provide [copies]’ did not stress and clearly reflect the importance of ‘access’ as explicitly stated in the regulations.”
A new subaward page, which contains sample foreign subrecipient agreement language, and an FAQ page on foreign subawards provide further detail.
Changes from Earlier Guidance: Frequency and Electronic Access
The final guidance—which takes effect January 1, 2024 and requires grant recipient compliance by March 2, 2024—updates earlier draft guidance issued by NIH on May 19, 2023 (see NIH Updated Policy Guidance for Subaward Written Agreements, Notice NOT-OD-23-133) and published in the Federal Register (88 Fed. Reg. 36,603 (June 5, 2023)).
That draft guidance required foreign subrecipients to provide records at least once every six months. The final guidance expands the permissible frequency to once per year, in recognition that progress reports are typically written once per year and that the guidance requires provision of “all documentation that supports the research outcomes as described in the progress report.” Another change in the final guidance is the stipulation that “access” to subrecipients’ data and other documentation may be given electronically. NIH suggests that this requirement may in many cases be met using digital file-sharing platforms.
NIH Response to Research Community Concerns
NIH stressed that the guidance and revisions to Section 15.2 were prompted by the HHS OIG and GAO’s audits, both of which raised specific concerns related to NIH’s oversight of awards with foreign recipients. Federal regulations require primary recipients to have effective internal controls to ensure that awards are being carried out in a compliant manner, and primary recipients acting as pass-through entities “must have the right of access to any documents, papers, or other records of the non-Federal entity which are pertinent to the Federal award[.]” 45 C.F.R. 75.303 & 45 C.F.R. 75.364.
In response to comments suggesting that the sharing of materials from laboratory notebooks is prohibited by the NIH Data Management and Sharing Policy, NIH emphasized that that policy refers to the sharing of data with the public. The oversight referenced in the final guidance, in contrast, “focuses on data and documents that collaborators should be sharing with each other to meet terms and conditions of grant awards and to assure satisfactory scientific progress.”
Implications for Higher Education Institutions
There is a great deal of concern within the U.S. research community that the new guidance will have a chilling effect on research collaborations and subject participation in global health research. Public comments to the guidance have focused broadly on concerns related to data, increased burden, and fairness. It is important for U.S. institutions leading international collaborations to be aware of these issues and address them early in the collaboration.
Data privacy. It will be far more complex, and in some cases impossible, to transfer the required research data to the U.S. in compliance with applicable international data privacy laws such as the European Economic Area General Data Protection Regulation (GDPR) and the People’s Republic of China Personal Information Protection Law (PIPL). When research data includes information that can be used to identify an individual (Personal Information), as is the case for most human subjects research projects, many international data privacy laws like the GDPR and PIPL require the foreign partner to implement a cross-border transfer safeguard to transfer the Personal Information to a U.S. research institution. Such cross-border safeguards typically require the foreign partner to execute standard contractual clauses with the U.S. research institution and/or obtain the research subjects’ consent to transfer their Personal Information to the U.S. research institution. This is problematic, as many U.S. research institutions cannot agree to some (unalterable) provisions of the standard contractual clauses, such as those requiring the institution to submit to foreign jurisdictions’ laws and legal systems. Additionally, if the research subjects did not consent to have their Personal Information transferred to the U.S. research institution when their Personal Information was initially collected, it is often difficult or impossible for the foreign partner to subsequently obtain their consent after partnering with a U.S. research institution. Under NIH’s previous guidance, U.S. research institutions often avoided troublesome international data privacy laws by collaborating to allow foreign partners to send only anonymized research results to the U.S. research institution. Unfortunately, this solution is no longer viable under NIH’s new guidance. At the outset of every research project that involves data containing Personal Information collected abroad, U.S. research institutions should carefully consider applicable international data privacy laws, like the GDPR and PIPL, to determine whether they will be capable of complying with the laws’ cross-border transfer requirements.
Unmanageable administrative and financial burden. Research institutions in many countries operate with severely limited resources. It has been noted that this situation is perpetuated by a broad discrepancy between NIH's 8% indirect cost rate for international sites and notably higher 30% indirect cost rate for U.S. institutions. The added administrative and financial costs of complying with this new guidance may simply be too high for international collaborators, which some in the U.S. research community fear will lead them to seek opportunities with partners other than the U.S. This may be particularly true for collaborators in Low and Middle-Income Countries (LMICs), where under-studied diseases are common and mutually beneficial research collaborations have increased significantly in the past decade. The new guidance will make it necessary for international research partners to identify new funding streams to procure additional equipment and software and to hire additional staff to support compliance. U.S. institutions will also be faced with additional administrative and financial costs related to additional training, monitoring for compliance, and providing a secure infrastructure to receive, store, and process the massive amount of data provided. In an attempt to preserve a valuable relationship, it is possible that some of these entities will identify ways to assume administrative duties and costs that might ordinarily be borne by the international partner. Sound budgeting and resource allocation will be more important than ever, as will the need to clearly communicate expectations and responsibilities early.
Discrimination, mistrust, and colonialism. Many in the U.S. research community have expressed a belief that these requirements are unfair and paternalistic to international collaborators and reflect discriminatory and colonialist practices resulting from U.S. mistrust in the skills and integrity of the international research community. It will be important for U.S. research institutions leading international collaborations to mitigate potential negative perceptions by carefully structuring the agreements supporting these collaborations. These agreements should clearly identify the international collaborators' intellectual contributions to the design and execution of a project and ensure the protection of intellectual property brought to and resulting from that project. Agreements must also clearly address the data ownership and data sovereignty of international research institutions and research participants as a clear indication of respect for their rights and their contributions to the project.