NIH's Contractor Paid $28.4 Million to Firms Its CEO Owns

Vibrent Health builds the phone and web apps that let more than a million volunteers enroll and share health data with NIH's All of Us Research Program⧉.▸ A U.S. Department of Health and Human Services Office of Inspector General audit released April 2, 2026⧉ found that starting the day its $172.5 million NIH award began, Vibrent subcontracted the bulk of that work to a company in India owned by Vibrent's own CEO -- and later to a second company, also CEO-owned, registered in Delaware. Vibrent itself is owned by the CEO's spouse.

Auditors found Vibrent paid those two related-party firms $28.4 million combined⧉ -- more than four times what it paid its next-highest-paid subcontractor -- at rates OIG calculated ran at least 2.05 times the going market rate⧉ for the same work in India.▸ Of the $161.2 million Vibrent claimed from NIH in all, OIG found $16.5 million unallowable or potentially unallowable⧉, and recommended Vibrent refund whatever NIH ultimately disallows. Vibrent disputes the findings in full.

NIH is one of a small number of federal agencies allowed to fund work through "other transactions" (OTs) -- flexible award instruments exempt from most of the standard federal contracting and grants rules, used to award more than $5.3 billion between 2016 and 2023⧉.▸ NIH used one to fund Vibrent's work on the All of Us Research Program, a long-running effort to collect health data from more than a million volunteers to study what drives individual health and disease. Under the award, called PTSC 2.0, NIH paid Vibrent $172,545,933 between August 2020 and December 2023⧉ to build and run the web and mobile platforms participants use to enroll, share data, and get program updates.

Vibrent -- formally Vignet, Inc. -- is a small IT firm in Fairfax, Virginia, owned by its CEO's spouse⧉.▸ From the first day of the PTSC 2.0 award, Vibrent subcontracted most of the technical work to a company in Pune, India, owned by its own CEO. Two years in, on October 1, 2022, it switched to a second related-party subcontractor -- a Delaware-registered company, also CEO-owned -- on largely the same terms. Because the companies on both ends of each subcontract answered to the same two people, OIG found these were not arm's-length transactions⧉, which created a risk the work wasn't billed at fair market value. NIH knew about and approved both related-party subcontracts.

Vibrent worked with roughly 30 subcontractors on the award.▸ The two owned by its CEO stood out: Vibrent paid them $28.4 million combined⧉ during the audit period -- its next-highest-paid subcontractor, an unrelated firm, received $6.8 million over the same stretch. To test whether that $28.4 million was reasonable, OIG compared the pay rates in the related-party subcontracts against average salaries for the same job titles at other India-based IT companies, using data from three job-recruiting websites and taking the highest of the three averages as its most conservative benchmark. Vibrent's related-party subcontractors were paid at least 2.05 times more per position, on average, than that benchmark⧉ -- for one example OIG cites, a "QA Lead" role paid about $131,000 through the related-party subcontracts, versus a highest India-market average of about $51,000 for the same title.

Applying that 2.05x benchmark to the full $28.4 million, OIG calculated that at most $13.8 million was reasonable, leaving at least $14.6 million unreasonable⧉ -- and, under federal cost principles that only allow reasonable costs, unallowable.▸ Auditors also found Vibrent's own paperwork for choosing the related-party subcontractors was limited to a single vendor-justification form that was neither signed nor dated⧉, and that the company had no board of directors or other independent function that could have checked the decision.

NIH's own review process largely missed it.▸ OIG found NIH's budget analyses were absent for 9 of the 11 funding actions that included related-party subcontract costs⧉; for the two actions where an analysis existed, NIH benchmarked the subcontractors' pay against U.S. labor costs rather than the India labor market where the work actually happened -- the opposite of the comparison OIG later used to flag the $14.6 million. Separately, NIH paid Vibrent a fee equal to 5% of its total costs⧉, a "cost-plus-a-percentage-of-cost" structure that OIG notes lacks the built-in spending caps of a fixed-price contract -- the higher Vibrent's costs ran, the higher its fee.

Vibrent's own compliance checks had gaps too.▸ The award required Vibrent to have independent financial-statement audits performed each year; those audits omitted the required Schedule of Expenditures of Federal Awards for fiscal years 2021 and 2022⧉, and when OIG asked what the audits actually covered, Vibrent's own auditors confirmed they had never tested whether Vibrent's costs were allowable or complied with federal cost principles -- the exact question this OIG audit ended up having to answer instead.

The related-party subcontracts weren't the only issue.▸ Vibrent also charged fringe-benefit and indirect-cost rates higher than what NIH had approved in its budget⧉, resulting in $1.9 million more than NIH allowed -- in 2023, OIG calculated Vibrent's claimed indirect-cost rate ran 17.07 percentage points above the approved rate. Combined with the $14.6 million subcontractor finding, OIG's total came to $16.5 million unallowable or potentially unallowable out of the $161.2 million Vibrent claimed⧉ for reimbursement between August 2020 and December 2023.

Vibrent disputed both findings at length in a written response OIG published in full⧉.▸ On the subcontractor costs, Vibrent's core argument is that NIH reviewed and approved the related-party subcontractors and their rates before the award even began, and again in each year's budget submission -- and that NIH, having approved those rates, has no legal basis to claw the money back now. Vibrent also argues OIG's benchmark was flawed: that the relevant labor market for cloud and software engineering talent is global, not just India-based, and that comparing its subcontractors' pay only to local India salary surveys understates what genuinely qualified, experienced engineers cost. On the indirect-cost finding, Vibrent says OIG used the wrong "approved" rate in the first place, citing a 47.84% indirect rate it says NIH separately negotiated for 2020 -- a rate OIG's report does not use.

OIG's published response maintains that its findings and recommendations are valid⧉: that NIH's approval of a budget doesn't waive the separate federal requirement that costs be reasonable, that its India-market benchmark follows federal rules requiring comparison to the market where work is actually performed, and that Vibrent never produced the kind of market analysis that might have justified the higher rates.▸ Vibrent did not state whether it concurs or disagrees with OIG's two recommendations: work with NIH to refund the $1.9 million and resolve the $14.6 million question, and separately, set up an independent oversight function for future federal awards. The report does not give an implementation timeline for either.