(a) Disclosure of the identity of respondents and complainants in research misconduct proceedings is limited, to the extent possible, to those who need to know, consistent with a thorough, competent, objective and fair research misconduct proceeding, and as allowed by law. Provided, however, that:

(1) The institution must disclose the identity of respondents and complainants to ORI pursuant to an ORI review of research misconduct proceedings under § 93.403.

(2) Under § 93.517(g), HHS administrative hearings must be open to the public.

(b) Except as may otherwise be prescribed by applicable law, confidentiality must be maintained for any records or evidence from which research subjects might be identified. Disclosure is limited to those who have a need to know to carry out a research misconduct proceeding.