1. Scope and Key Definitions

Who Is Covered

• Faculty and staff with research responsibilities
• Graduate and undergraduate students conducting research
• Postdoctoral researchers and visiting scholars
• Subawardees and collaborators using university facilities or data

What Counts as "Research"

For compliance purposes, research is a systematic investigation, including research and development, designed to develop or contribute to generalizable knowledge. This includes work funded by federal agencies, private sponsors, or conducted independently, when it involves human subjects, animals, biosafety risks, export-controlled technology, or personally identifiable information.

Key Compliance Offices (typical)

2. Research Integrity and Ethical Standards

The Three Cardinal Sins of Research

All researchers are prohibited from the following, regardless of funding source or disciplinary field:

• Fabrication — making up data or results and recording or reporting them
• Falsification — manipulating research materials, equipment, or processes, or changing/omitting data so that the record is not an accurate representation of the results
• Plagiarism — appropriating another person's ideas, processes, results, or words without giving appropriate credit

Additional Ethical Prohibitions

• Duplicate or triple publication of the same results without disclosure and permission
• Citation manipulation (self-citation inflation, citation rings)
• Peer review fraud (ghost review, self-review)
• Misrepresentation of qualifications, methods, or findings
• Improper authorship — granting authorship as a gift or omitting those who made substantive contributions

Responsible Conduct of Research (RCR) Training

All individuals engaged in research must complete institutional RCR training. Typical requirements include:

• Initial RCR training within the first semester of enrollment or appointment
• Refresher training every 2–3 years
• Discipline-specific modules (e.g., clinical research, animal research, data integrity)

3. Human Subjects Research (IRB)

What Requires IRB Review

Any systematically conducted investigation involving living individuals (or their legal representatives) from which generalizable knowledge is produced requires IRB review. This includes:

• Interviews, surveys, focus groups, and observations of identifiable individuals
• Collection of biospecimens (blood, tissue, saliva, etc.)
• Interventions, including behavioral, educational, or medical
• Use of identifiable private information, including electronic data, social media posts, or existing records
• Research conducted with students in a course (when the research is separate from the learning activity and involves risk beyond that of everyday life)

IRB Review Pathways

Core Requirements

• Informed Consent: Participants must receive a clear description of the study, its risks, benefits, and their right to withdraw without penalty. Waivers are granted only under specific regulatory conditions.
• Minimal Risk: Research must not expose participants to risks greater than those encountered in daily life, unless justified by potential benefit.
• Confidentiality: Data must be de-identified or coded, and stored securely per institutional data privacy policy.
• Vulnerable Populations: Additional protections apply for children, prisoners, pregnant women, and individuals with impaired decision-making capacity.
• Continuing Review: Approved protocols require annual renewal and immediate reporting of any protocol changes or unanticipated problems.

4. Data Privacy and Protection

Applicable Federal Frameworks

Core Data Privacy Obligations

• Minimization: Collect only the data necessary for your research question. Avoid collecting sensitive data unless essential.
• De-identification: Remove or code direct identifiers (name, SSN, email, student ID) before analysis. Use the HIPAA Safe Harbor or Expert Determination standards where applicable.
• Secure Storage: Store data on university-approved systems. Encrypt data at rest and in transit. Do not store research data on personal devices or unapproved cloud services.
• Access Control: Limit data access to authorized team members. Use role-based access controls and audit logs.
• Data Retention and Disposal: Retain data only as long as required by the sponsor or institutional policy. Dispose of data securely when the retention period ends.
• Third-Party Sharing: Do not share identifiable data with external parties without a Data Use Agreement (DUA) or equivalent contractual protection.

Biometric and Sensitive Data

Research involving biometric data (face, voice, fingerprint, iris) or sensitive personal data (health, race, religion, sexual orientation, political opinion) requires additional safeguards, including explicit consent, enhanced security controls, and (in some states) compliance with state biometric information laws.

5. Data Security and Cybersecurity

Baseline Requirements

• Use only university-approved devices and storage for research data
• Enable multi-factor authentication (MFA) on all research accounts
• Encrypt sensitive data in transit (TLS) and at rest (AES-256 or equivalent)
• Apply security patches promptly; do not disable antivirus or endpoint protection
• Report lost or stolen devices containing research data immediately to IT Security
• Use only approved file-sharing services; avoid consumer cloud storage for sensitive data

Incident Response

• Report any suspected data breach or security incident within 24 hours of discovery
• Preserve evidence — do not delete logs, files, or devices that may be relevant
• Cooperate with IT Security, Privacy Office, and Legal in the investigation
• Notify the IRB, sponsor, and affected individuals as required by institutional policy and applicable law

6. Animal Research (IACUC)

• All research involving live vertebrate animals requires IACUC protocol approval before any procedure is performed
• The 3Rs principle guides design: Replacement (use non-animal methods where possible), Reduction (use the fewest animals necessary), and Refinement (minimize pain and distress)
• Personnel must complete animal care and use training before working with animals
• Procedures must follow the Guide for the Care and Use of Laboratory Animals (NRC) and, where applicable, the Animal Welfare Act
• Any change in procedures, species, or personnel requires prior IACUC approval
• Unanticipated problems or protocol deviations must be reported to the IACUC immediately

7. Biosafety (IBC)

• Research involving select agents or toxins requires IBC approval and, in many cases, federal registration with the CDC or USDA
• Personnel must be trained in biosafety practices appropriate to the risk group of the agents used
• Appropriate containment (biosafety cabinets, personal protective equipment) must be used per the BMBL
• Incidents involving exposure, spills, or equipment failure must be reported to the IBC and, where required, to public health authorities

8. Export Controls

• Technology, software, or data subject to export controls may not be shared with foreign nationals without the appropriate license or exemption
• Researchers must identify whether their work involves controlled items (dual-use technology, encryption, defense articles) before involving international collaborators
• Foreign national access to controlled technology may require a technology control plan (TCP)
• Violations of export control laws are criminal offenses with severe penalties for both the individual and the institution

9. Intellectual Property and Inventions

• Inventions made in the course of sponsored research are generally owned by the university under the Bayh-Dole Act (35 U.S.C. § 200 et seq.) or the sponsor's agreement
• Researchers must disclose inventions promptly to the Office of Technology Transfer or equivalent
• Publication of research results is a core academic value, but sponsored agreements may impose publication review periods (typically 30–60 days) to protect patent rights
• Background IP (pre-existing) must be identified and documented at the start of a project to avoid ownership disputes
• Open-source and data-sharing obligations under grant terms must be honored

10. Conflicts of Interest and Commitment

Financial Conflicts of Interest (FCOI)

• Researchers must disclose significant financial interests that could be perceived as affecting their research (equity, consulting fees, royalties, patents)
• Disclosures are made annually and at the start of each sponsored project
• The university must develop and implement a management plan to mitigate or eliminate the conflict

Conflicts of Commitment

• Researchers must disclose outside employment or activities that could interfere with their university responsibilities
• Graduate students and postdocs with assistantships must ensure outside work does not conflict with their appointment duties

11. Sponsored Research Compliance

• Follow the terms and conditions of every grant, contract, or cooperative agreement
• Use federal funds only for allowable, allocable, and reasonable costs (Uniform Guidance, 2 CFR 200)
• Maintain accurate records of all expenditures, including indirect costs (F&A) and direct costs
• Report progress, milestones, and final outcomes to the sponsor as required
• Observe sponsor-specific requirements for publication, data sharing, and personnel effort reporting
• Subaward agreements must be executed before the subrecipient begins work

12. Publications, Authorship, and Data Sharing

Authorship Standards

Authorship should reflect substantive intellectual contribution, as defined by the ICMJE or equivalent discipline-specific guidelines:

• Substantial contribution to the conception, design, execution, or interpretation of the research
• Drafting or critically revising the manuscript
• Final approval of the version to be published
• Agreement to be accountable for all aspects of the work

Publication Ethics

• Disclose all conflicts of interest, funding sources, and data availability in every publication
• Do not submit the same manuscript to multiple journals simultaneously (duplicate submission)
• Correct errors promptly through a correction or erratum when results are found to be inaccurate
• Retract papers when there is compelling evidence of unreliable findings, not merely because results are unfavorable

Data and Code Sharing

• Many federal sponsors (NIH, NSF, DOE) require public data sharing in repositories upon publication
• Develop a Data Management Plan (DMP) before starting research, especially for federally funded projects
• Code and analysis scripts should be archived alongside data to ensure reproducibility

13. Recordkeeping and Documentation

• Maintain complete and accurate records of all research activities, including lab notebooks (physical or electronic), data sets, analysis scripts, and correspondence
• Records must be retained for the period required by the sponsor, institutional policy, or applicable law (typically a minimum of 3 years after final expenditure)
• Electronic records must be backed up and protected against unauthorized modification
• Lab notebooks should be dated, signed, and maintained contemporaneously — back-dated or reconstructed records are not acceptable

14. Required Compliance Training

• Responsible Conduct of Research (RCR) — all researchers, first semester
• Human Subjects Protection — all individuals involved in human subjects research
• FERPA / Student Privacy — faculty, GAs, and staff with access to student records
• HIPAA Privacy and Security — research involving protected health information
• Animal Care and Use (IACUC) — all individuals working with animals
• Biosafety (IBC) — all individuals working with biohazardous materials
• Data Security and Privacy — all researchers handling sensitive or identifiable data
• Export Control Awareness — researchers with international collaborators or controlled technology
• Financial Conflict of Interest — all faculty and PIs on sponsored projects
• Research Data Management — all researchers, especially those on federally funded grants

15. Reporting Concerns and Enforcement

How to Report a Compliance Concern

• Informally: Discuss with your supervisor, department chair, or the relevant compliance office
• Formally: File a written report with the Research Integrity Officer, Compliance Office, or the designated ethics hotline
• Externally: Report to the funding agency (e.g., ORI for NIH/NSF) if the concern is not resolved internally

Non-Retaliation

The university prohibits retaliation against any individual who, in good faith, reports a compliance concern, participates in an investigation, or refuses to participate in research misconduct. Retaliation is itself a serious violation subject to disciplinary action.

Sanctions (typical range)

Quick Reference: Compliance by Research Type

Where to Get Help

• Research Compliance Office / Research Integrity Officer — general compliance questions, RCR, misconduct reporting
• Institutional Review Board (IRB) — human subjects research questions, protocol submissions
• Institutional Animal Care and Use Committee (IACUC) — animal research questions
• Institutional Biosafety Committee (IBC) — biosafety and select agent questions
• Privacy Office / Data Protection Officer — FERPA, HIPAA, data privacy, and security questions
• Office of Sponsored Programs / Research — grant compliance, export controls, IP, and subawards
• Information Technology Security — data security, incident response, and system access
• Office of the General Counsel — legal questions, contracts, and regulatory interpretation
• Ethics Hotline (anonymous) — report concerns confidentially or anonymously