NIH FY25 Human Research Policy Notice Summary

Modified on March 5, 2026 to remove the “subscribe” option. This blog has been retired and replaced by the S.P.I.R.I.T. newsletter.

Eager to skip ahead to today’s content?

Jump to the Table of Contents.

• LinkedIn
• Mail
• Bluesky
• Facebook

Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

320+ subscribers and counting!

We are just about 70% done with the first month of FY26.

I also like to share these updates within other professional forums such as PRIM&R. As I’ve mentioned on LinkedIn and through the blog, it is tough to keep up with everything. I especially felt that way given all the CY25 events that have happened and are still going! Why shouldn’t we think of ways to make things easier for folks in the research regulatory field. This is especially critical now given the evolving regulatory landscape.

I’d like to continue to provide research regulatory updates via CREST and my personal LinkedIn. For today’s article, I’d like to cover the NIH FY25 Human Research Policy Notices:

• I’ll start with a summary matrix for each policy which will include:
  • A brief explanation of the purpose
  • Key dates
  • Related policy notices
  • Related resources to better understand each policy
• Then, we will deep dive into each notice.
  • Essentially, I will directly quote/detail out any key information that was not provided in the matrix.

This is inspired by my LinkedIn post related to the NIH FY25 Policy Pulse. If you didn’t see the post, don’t worry! I’m going to cover this as well.

As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

Table of Contents:

1. NIH FY25 Policy Pulse
   1. Human Research FY25 Policy Notice Dashboard
2. NOT-OD-25-081: Protecting Human Genomic Data when Developing Generative Artificial Intelligence Tools and Applications
3. NOT-OD-25-083: Implementation Update: Enhancing Security Measures for NIH Controlled-Access Data
4. NOT-OD-25-131: Revision: NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research
5. NOT-OD-25-134: Flexibilities for Registration and Results Reporting of Prospective Basic Experimental Studies with Human Participants
6. NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations
7. NOT-OD-25-159: Required Security and Operational Standards for NIH Controlled-Access Data Repositories
8. NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

---

NIH FY25 Policy Pulse

The NIH FY25 Policy Pulse includes policy notice updates issued by the NIH in FY25 related to:

• Grants management,
• Human research,
• Animal research, and
• Biological research.

This also includes a list of rescinded policy notes. This doesn’t include funding announcements or any other changes from other HHS agencies.

• If there is a policy update I missed, please leave a comment below or email me at crest.innovation25@gmail.com! I would love to credit you on revisions to this summary tool.

Human Research FY25 Policy Notice Dashboard

Before we dive in each of these policy updates, I wanted to provide a summary dashboard below:

• Please note that there are also two policy updates related to biological research within the dashboard. These two updates also relate to human research:
  • NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations
  • NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

(Back to the Top)

NOT-OD-25-081: Protecting Human Genomic Data when Developing Generative Artificial Intelligence Tools and Applications

The policy further describes:

• The Genomic Data Sharing (GDS) Policy and the subsequent Data Use Certification (DUC) Agreement:
  • Prohibit users from distributing controlled-access data (including genomic or associated data) or their Data Derivatives to any entity or individual not identified in their Data Access Request without appropriate written approvals from the NIH
  • States that sharing, retaining, or training generative AI models using controlled-access human genomic data may risk disclosing controlled-access data and, thus, violates the Non-Transferability provision of the DUC
  • Further, it states that sharing controlled-access data with public generative AI tools (e.g., third party tools) via prompts or other user interfaces is in violation of the provision on Non-Transferability, and by extension, the DUC
• NIH intends to provide future guidance on the responsible use and sharing of generative AI models and controlled-access data
  • Until that guidance is issued, as described in the DUC, Approved Users of controlled-access data may continue to develop generative AI models using the controlled-access data so long as the use is approved by NIH, but:
    • (1) may not share the model, including model parameters, except with collaborators who are also Approved Users and
    • (2) may not retain the generative AI model, including model parameters, upon closeout of the project as instructed in provision 13.

(Back to the Top)

NOT-OD-25-083: Implementation Update: Enhancing Security Measures for NIH Controlled-Access Data

The policy doesn’t offer additional details to discuss.

(Back to the Top)

NOT-OD-25-131: Revision: NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research

Though there are no specific resources, the policy further describes:

• A brief background of NIH charged with establishing guidelines for inclusion of women and racial and/or ethnic minorities in clinical research
• NIH sets the expectation that women and members of racial and/or ethnic minority groups and their subgroups must be included in all NIH-funded clinical research, unless a clear and compelling rationale and justification that inclusion is inappropriate with respect to the health of the participants or the purpose of the research
• Cost is not an acceptable reason for exclusion except when the study would duplicate data from other sources
• Pregnant women should not be routinely excluded from participation in clinical research
• When an NIH-defined Phase 3 clinical trial is proposed, evidence must be reviewed to show whether or not clinically important sex, race, and/or ethnicity differences in the intervention effect are to be expected
  • For NIH-defined Phase 3 applicable clinical trials, submissions of results to ClinicalTrials.gov must include results of valid analyses by sex and race and/or ethnicity, as required based on prior evidence
• Roles and responsibilities are listed to ensure successful implementation of this policy
• The policy concludes with a list of definitions and associated regulations

(Back to the Top)

NOT-OD-25-134: Flexibilities for Registration and Results Reporting of Prospective Basic Experimental Studies with Human Participants

In further detail, the policy explains:

• BESH studies meet both the NIH definition of a clinical trial and also the definition of basic research.
• NIH is indefinitely extending the period of delayed enforcement for registration and results reporting including those with application due dates on or after September 25, 2025.
• Plans for meeting the NIH registration and results reporting expectations using an alternative platform should be described at the time of application in the Dissemination Plan attachment.
• NIH continues to expect Good Clinical Practice (GCP) training for all personnel involved in the conduct, oversight, or management of all BESH.
  • Check out this CREST GCP article for more background: ICH GCP E6(R3) vs. E6(R2): Guideline Differences

As there wasn’t space within the matrix, resources mentioned within the policy are listed below:

• NIH Policy on the Dissemination of NIH-Funded Clinical Trial Information
• NIH definition of a clinical trial
• Basic research
• ClinicalTrials.gov
• Good Clinical Practice
• Posting of informed consent forms
• PHS Human Subjects and Clinical Trials Information form
• Clinical trial review criteria
• Simplified Review Criteria
• BESH resources webpage
• Special Considerations for BESH webpage

(Back to the Top)

NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations

In addition to providing general definitions, the policy further describes the five options in detail.:

• Direct return of biospecimens to Tribe(s)
  • The de-identified biospecimens can be returned directly to Tribe(s) if Tribe(s) is able to receive biospecimens per applicable national, state, and local laws and regulations and per Tribal customary practices and regulations
• Indirect return of biospecimens to a third-party institution or organization identified by Tribe(s)
  • When de-identified biospecimens are NIH held and a NIH decision for disposition has been made, de-identified biospecimens can be returned to a Tribally designated third-party institution or organization if the third-party institution/organization is able to receive biospecimens per applicable national, state, and local laws and regulations and per Tribal customary practices and regulations
• Indirect return of biospecimens to third-party institution or organization identified by NIH in consultation with Tribe(s) and organized by NIH
  • When de-identified biospecimens are NIH held and a NIH decision for disposition has been made, de-identified biospecimens can be returned to a third-party institution or organization identified by NIH in consultation with Tribe(s) that is able to receive biospecimens per applicable national, state, and local laws and regulations
• After consultation with Tribe(s), Tribe(s) designates NIH as steward for biospecimens
  • IH and Tribe(s) can develop mutually agreed upon terms for continued stewardship and de-identified biospecimen access, in accordance with applicable federal laws, regulations, and policies, and in alignment with Tribal preferences
• After consultation with Tribe(s), Tribe(s) requests NIH dispose of biospecimens in culturally sensitive manner
  • Tribe(s) can instead request that NIH dispose of de-identified biospecimens
  • Disposal must be in accordance with applicable federal law, regulations, and policy, and occur in a culturally sensitive manner as identified through Tribal Consultation

(Back to the Top)

NOT-OD-25-159: Required Security and Operational Standards for NIH Controlled-Access Data Repositories

The policy further describes background, scope, applicability, and states:

• NIH Controlled-Access Data Repository (CADRs) should follow the “National Institutes of Health (NIH) Controlled-Access Data Repository Guidebook to Adhere to “Required Security and Operational Standards for NIH Controlled-Access Data Repositories” guidebook
• NIH CADRs that cannot satisfy these requirements may choose to migrate controlled-access data to another NIH CADR that is compliant with these requirements
• NIH CADRs must comply with the following categories of requirements as described in the NIH CADR Guidebook by specific effective dates:
  • Effective immediately:
    • NIH CADR Registration and Immediate Steps
  • Effective November 1, 2025:
    • Documentation of Adherence to Relevant Laws and Policies
    • Standard Data Access Processes
  • Effective February 25, 2026:
    • Standard Data Submission Processes
    • Security Standards and Practices
    • Transparency and Utility Standards

(Back to the Top)

NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

The policy further describes:

• The entity (e.g., biorepository, institution, investigator) that holds human biospecimens of U.S. persons collected, obtained, stored, used, or distributed using on-going or new NIH funds are prohibited from directly or indirectly distributing the human biospecimens to institutions or parties located in countries of concern
• The human biospecimens may be shared or distributed to countries of concern only if use of the human biospecimens is:
  • To meet transactions required or authorized by Federal law or international agreements, including Global health, or necessary for compliance with Federal law; or
  • Needed in rare and compelling circumstances where the facility and personnel in the country of concern possess needed capabilities and/or expertise not available elsewhere, the use of the biospecimen cannot be delayed to a time when capability and/or expertise is available elsewhere, and done with the consent of the individual from whom the biospecimen was collected; or
  • At the request of the individual whose biospecimen was collected, obtained, or stored using NIH-funds; for purposes of diagnosis, prevention or treatment of that individual; and in compliance with applicable Federal laws, regulations, and policies

As there wasn’t space within the matrix, resources mentioned within the policy are listed below:

• EO 14117
• Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons
• Executive Order 13873
• Countries of concern
• Transactions required or authorized by Federal law or international agreements
• Export administration regulations

(Back to the Top)

---

I hope you found this article useful!

(Back to the Top)