NIH Received 697 Foreign-Interference Allegations Against Grant Researchers Since 2017 and Found Violations in 264, GAO Says

The National Institutes of Health received 697 allegations of potential foreign interference involving researchers on its awards from 2017 through 2025 and found violations of its disclosure rules in 264 of them, according to a Government Accountability Office report released Friday.

The report, GAO-27-107848, "Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management," is dated Oct. 5, 2026, and was made public Oct. 16. It was requested by House Energy and Commerce Committee Chairman Brett Guthrie, subcommittee chairmen H. Morgan Griffith and John Joyce, and Reps. Earl "Buddy" Carter and Gary Palmer. NIH awarded about $35 billion in outside research funding in fiscal 2025 alone, according to the report.

What GAO Found on NIH Foreign Interference Allegations

Of the 264 allegations where NIH found violations, 238 involved what NIH treats as serious violations: undisclosed participation in a foreign talent recruitment program or undisclosed foreign funding. The other 26 involved only an undisclosed foreign affiliation, which NIH does not consider serious, the report says. NIH found no disclosure violation in the remaining 433 allegations.

NIH or the researchers' institutions took one or more actions in 223 of the 264 cases with violations. In cases with serious violations, NIH removed 199 people from possible service as peer reviewers and received repayment of funds from 48 institutions or people. NIH or another federal agency referred 18 people to an HHS office, which issued government-wide suspensions or debarments for 15 of them, barring them from federally funded research. Institutions fired 114 people, or they resigned, and barred 52 from working on NIH awards at the institution.

Actions were also taken in 45 of the 433 cases where NIH found no violation, mostly removals from peer review, GAO said.

Most allegations came from NIH staff, with the rest from the FBI or from institutions reporting on themselves. NIH officials told GAO that allegations surged at first, partly over earlier conduct, and generally declined as institutions improved compliance.

"Relies Heavily" on Self-Reporting

GAO found that NIH "relies heavily on self-reported information disclosed by researchers and institutions" to spot foreign interference risks, and "generally does not verify such disclosures using sources outside those required during pre-award risk assessments unless it receives a foreign interference allegation."

NIH also does not require researchers to disclose all past affiliations, and foreign components of a project must be disclosed only when a significant part of the NIH-funded work is done outside the United States. "As a result, NIH may not identify risks when relevant information is not required to be disclosed or is left out," GAO wrote.

According to NIH officials, the agency monitors access to its grants computer system by users in certain countries, including China, Iran, North Korea and Russia, and as of April 2025 had blocked 25 institutions and hundreds of individuals from it.

Seven Case Studies

GAO identified about 141,000 scientific publications from Jan. 1, 2024, to May 5, 2025, that credited NIH awards. Of those, 634, or 0.4 percent, had at least one co-author tied to an institution on a Defense Department list of foreign institutions whose activities, according to DOD, raise the risk that U.S.-funded research could be misappropriated.

GAO picked five awards from that group for case studies. In three, researchers had foreign affiliations that were not disclosed to NIH. In one example, the lead researcher on an award "held five honorary professorships at Chinese universities that were not disclosed in the application or progress reports," the report says. Because the dates of those affiliations were unclear, GAO said it could not determine whether disclosure was required, and it stressed that its observations "do not demonstrate policy violations."

NIH officials told GAO they had received no allegations about those five awards, but that some of the information GAO found was "potentially concerning," and that they would conduct more reviews to decide whether to open compliance cases. NIH officials also said that in two of the cases the award had nothing to do with the publication that credited it and may have been listed to pad the award's publication count.

GAO's two other case studies were awards where NIH had already acted on allegations, ordering the institutions to withhold the NIH-funded share of the researchers' salaries while cases were open. In one, NIH required the researcher to stop collaborating with colleagues in China in connection with the award. In the other, NIH decided the researcher was not required to disclose the Chinese funding that triggered the allegation. Both researchers began receiving NIH funds again after their cases closed, and both kept co-authoring papers with people affiliated with multiple institutions on the DOD list, GAO said.

GAO's Recommendation and NIH's Response

GAO found NIH had put in place 14 of the 15 federal research security requirements it reviewed. For the last one, which requires certain institutions to certify that they run research security programs, NIH is working with an interagency group, the report says.

GAO also found NIH's risk management is not fully aligned with GAO's Fraud Risk Framework. Although NIH's yearly risk inventory considers fraud, it is not a documented assessment of fraud schemes, controls and remaining risks specific to NIH's outside research grants. GAO recommended that the NIH director conduct and document such an assessment at regular intervals, considering foreign interference risks.

In comments reproduced in the report, the Department of Health and Human Services "stated that NIH concurred with our recommendation," GAO wrote. HHS said NIH plans to fold elements of the fraud framework into its existing risk management, strengthen how its annual risk reviews consider fraud, and periodically conduct and document a fraud risk assessment for its outside research program that considers foreign interference. GAO said those steps would address the recommendation if carried out as described.

GAO's draft also recommended that institution-run research security training cover the risks of malign foreign talent recruitment programs. NIH agreed and in August 2026 added that requirement to its grants website, which GAO said addressed the draft recommendation.

In an email to TDFP, GAO said it had no additional statement beyond the report. TDFP has also asked NIH for comment and will update this story.

Sources: GAO-27-107848, "Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management" (dated Oct. 5, 2026; released Oct. 16, 2026): https://www.gao.gov/products/gao-27-107848 ; full text: https://files.gao.gov/reports/GAO-27-107848/index.html