Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management

What GAO Found

The National Institutes of Health (NIH) funds extramural research through awards to universities and other institutions. Implementation of federal research security requirements helps safeguard this research from foreign interference, including misappropriation and unauthorized access by foreign countries and entities.

NIH implemented 14 of the 15 federal research security requirements GAO reviewed that address: (1) disclosure, (2) malign foreign talent recruitment programs, (3) research security training and programs, and (4) collaboration and information sharing. These requirements apply across federal research agencies and include actions NIH must take, as well as requirements it must impose on grant applicants, recipients, and specified individuals. For the remaining requirement concerning certification by certain recipient institutions that they have established and operate research security programs, NIH is working with an interagency group to implement the requirement.

NIH relies heavily on self-reported information disclosed by researchers and institutions to identify and manage foreign interference risks and generally does not verify such disclosures using sources outside those required during pre-award risk assessments unless it receives a foreign interference allegation. Additionally, NIH does not require disclosure of all past affiliations, and foreign component disclosures are only required when the collaboration involves the performance of a significant element or segment of the NIH-funded project outside of the United States. As a result, NIH may not identify risks when relevant information is not required to be disclosed or is left out.

From 2017 through 2025, NIH received 697 allegations of potential foreign interference involving personnel on NIH awards. NIH identified disclosure violations in 264 cases, and NIH or recipient institutions took one or more actions in most of those cases, such as prohibiting individuals from participating on awards.

NIH Allegations of Potential Foreign Interference and Outcomes, 2017–2025

Source: GAO analysis of National Institutes of Health data. | GAO-27-107848

In seven nongeneralizable case studies, GAO used outside sources to identify publicly available information about foreign affiliations and coauthored publications that did not appear in the award documentation. These cases do not establish the prevalence of undisclosed information or foreign interference across NIH awards but illustrate potential limitations of NIH’s disclosure-based process.

NIH’s risk management program is fully aligned with GAO’s enterprise risk management practices but not fully aligned with GAO’s Fraud Risk Framework. Although NIH’s annual risk inventory considers fraud, it is not a documented extramural-program-specific assessment of fraud schemes, controls, and residual risks. Without such an assessment, NIH lacks a documented basis for determining whether its controls and monitoring activities address the most significant fraud risks and are adjusted as those risks evolve.

Why GAO Did This Study

The U.S. has long promoted an open and collaborative research environment, but policymakers have raised concerns that foreign countries and entities may exploit the openness of the federally funded research enterprise to undermine national security and economic competitiveness. In fiscal year 2025 alone, NIH awarded about $35 billion in extramural funding.

GAO was asked to review NIH’s efforts to safeguard extramural research from foreign interference and related ethical concerns. This report examines, among other things: (1) NIH’s implementation of selected federal research security requirements, (2) the extent to which NIH identifies and manages foreign interference risks in its extramural research program, and (3) the alignment of NIH’s risk management policies and practices with GAO risk management practices.

GAO reviewed relevant legal authorities, policies, and NIH documentation; analyzed NIH foreign interference allegation data from 2017 through 2025; conducted seven nongeneralizable case studies of NIH awards selected based on their potential for heightened foreign interference risk; compared NIH practices with GAO risk management frameworks; and interviewed NIH and Department of Health and Human Services officials.