42 C.F.R. 93.108 provides in pertinent part, “Disclosure of the identity of respondent and complainants in research misconduct proceedings is limited, to the extent possible, to those who need to know, consistent with a thorough, competent, objective and fair research misconduct proceeding, and as allowed by law.”  NIH has issued a policy explaining when NIH has a need to know about matters related to research misconduct proceedings.  Institutions may consider that NIH policy when determining disclosures to those who need to know, consistent with 42 C.F.R. 93.108.

To read the policy in full click here. https://grants.nih.gov/grants/guide/notice-files/NOT-OD-19-020.html