How the DOJ’s bulk data rule made reach, not storage, the health data test

The week

On July 8, 2025, a federal rule began asking a new question about patient data, with full enforcement behind it: who could reach it? For years, health care leaders had learned to ask whether it was protected.

The rule is the Justice Department’s Data Security Program. It is a final rule issued under Executive Order 14117 and codified at 28 CFR Part 202, which is simply its address in the Code of Federal Regulations, the official rulebook of federal agencies. It took effect on April 8, 2025.

The rule prohibits or restricts transactions that could give countries of concern, or covered persons linked to them, access to bulk U.S. sensitive personal data or government-related data. “Bulk” means large volumes of records, above set thresholds. “Covered persons” are the companies and individuals the rule treats as connected to those countries. The countries of concern are China, including Hong Kong and Macau, Cuba, Iran, North Korea, Russia and Venezuela.

The rule did not arrive with an immediate crackdown. In April, the department announced a limited enforcement policy for the first 90 days, through July 8, 2025, for organizations making good-faith efforts to comply. It amounted to a grace period: room for organizations to get organized, provided they were genuinely trying. Alongside it, the department published a compliance guide and answers to frequently asked questions.

The week of July 7 marked the end of that grace period. Full enforcement applied after July 8. A second wave was also on the calendar: due diligence, audit and reporting requirements followed on October 6, 2025. Due diligence here means the documented checking an organization does on its partners before and during a relationship; the audits are independent reviews that the checking and the controls actually work.

For hospital systems, academic medical centers, research institutes and drug and device makers, the end of the grace period meant something practical. A contract with a data analytics vendor, a research collaboration or a new hire with access to a data platform could now carry federal national security consequences. And the people best placed to spot those risks were not, for the most part, in the privacy office.

Health systems and life sciences companies judge data risk through HIPAA, the Common Rule, state privacy laws and, abroad, the GDPR. HIPAA is the federal law that governs how hospitals, insurers and their contractors handle patient health information. The Common Rule is the federal policy protecting people who take part in research. The GDPR is the European Union’s broad privacy law. All of them ask whether data is protected and used for permitted purposes.

The Data Security Program asks a different question: could certain foreign parties gain access to the data in bulk through a commercial relationship? It works more like export control than privacy law. Export control is the system that stops certain sensitive goods and technology from being shipped to certain countries. It does not care whether the shipment is well packaged; it cares where it is going and who will receive it. The Data Security Program applies a similar logic to data.

That shifts the work away from the privacy office toward the functions that create relationships: procurement, research administration and human resources. Three parts of the rule matter most: which data is in scope, which relationships create access, and what an organization must be able to prove after October 2025.

A different kind of rule: reach, not storage

The shift is an unfamiliar one. For two decades, health data protection has centered on the vault: encryption, firewalls, access controls and breach response. The working assumption has been that if the vault is strong and the people with keys are authorized, the data is safe.

The Data Security Program accepts none of that as sufficient on its own. A perfectly secure, encrypted, fully compliant data warehouse can still be in breach of the rule if the wrong person, in the wrong country, working for the wrong company, has a legitimate login. The question is not whether the vault is strong but who has been handed a key, and where they live and work.

Which data is in scope

The rule covers six categories of sensitive personal data held in bulk: human genomic and other omic data, biometric identifiers, precise geolocation data, personal health data, personal financial data and certain covered personal identifiers.

A few of these deserve explanation. Genomic data is information about a person’s DNA. Other omic data covers related biological readouts, such as data about the proteins or other molecules in a person’s body; the “-omics” label is shared across these fields. Biometric identifiers are physical traits used to recognize someone, such as fingerprints or facial images. Precise geolocation data shows where a person’s device has been, often down to a building.

The thresholds

Each category has a threshold counted over twelve months. Human genomic data is in scope above 100 U.S. persons, and other human omic data above 1,000. Personal health and financial data are in scope above 10,000 U.S. persons. Government-related data, such as data linked to current or recent federal personnel, is covered at any volume.

Two features that catch organizations out

Two features catch healthcare organizations out. First, the rule counts data even when it has been anonymized, pseudonymized, de-identified or encrypted. Anonymized and de-identified data has had names and other direct identifiers stripped out; pseudonymized data has had them replaced with codes; encrypted data has been scrambled so it can be read only with a key. Under health privacy law, these steps often change how data may be shared. Under this rule they do not take it out of scope. A data set released under HIPAA’s de-identification standard can still be covered data.

Second, the genomic threshold is low enough that a single sequencing study, biobank extract or rare-disease registry can cross it. A biobank is a stored collection of biological samples and associated data used for research; a registry is a database tracking patients with a particular condition. A research institute that treats its genomic collaborations as small because each involves a few hundred participants may be wrong under this rule.

The first task: a data map

The first practical task is a data map that records, for each major data set, its categories, the number of U.S. persons over the past year and whether it is shared outside the organization. Few health systems have that view, because no earlier rule required counting people across data sets this way. Privacy teams typically know which systems hold protected health information, but not how many distinct people sit in each data set, or which of them are genomic.

Which relationships create access

The rule prohibits two kinds of transaction with countries of concern or covered persons: data brokerage, meaning the sale or licensing of access to covered data, and any transaction giving access to bulk human omic data or the biospecimens from which it could be derived. Biospecimens are physical samples, such as blood or tissue, from which genetic and other data can be produced. Prohibited means exactly that: no amount of security makes these transactions acceptable.

It restricts three others, which are allowed only if security requirements set by CISA are met: vendor agreements, employment agreements and investment agreements. CISA is the Cybersecurity and Infrastructure Security Agency, the federal civilian cyber defense agency, which wrote the specific security conditions these relationships must satisfy.

People as well as companies

The restricted categories are where most healthcare exposure sits, and they turn on people as much as companies. Covered persons include entities owned 50 percent or more by a country of concern, and individuals primarily resident in one.

A U.S. analytics vendor whose support engineers in Shanghai can query a hospital’s claims warehouse may bring an ordinary services contract into scope. A claims warehouse is the large database where a health system or insurer stores billing and treatment records for analysis. So can hiring a contractor in a country of concern with administrator rights over a research data platform. Administrator rights are the highest level of access, allowing someone to see and change everything.

Suppose a regional health system signs a contract with a U.S.-based analytics firm to build dashboards on its claims data. The contract is ordinary, the firm is reputable and its security is strong. But the firm’s overnight support team works from a country of concern and can log in to fix problems. Nobody in the privacy office would see a problem; the data never leaves U.S. servers. Under this rule, that login may be the issue.

Onward transfer

Onward transfer matters too. An organization that licenses covered data to a foreign party outside the countries of concern must include contract terms barring onward transfer to them, and report known violations. Onward transfer is when the party you share data with passes it to someone else. A license to a partner in a friendly country therefore still needs terms that stop the data from traveling on.

Why ownership moves out of the privacy office

This is why ownership falls to procurement, research administration and HR. Procurement must ask vendors about ownership, the location of staff with data access and subcontractors. Research administration must review data use and material transfer agreements for foreign counterparties. A data use agreement sets the terms for sharing research data; a material transfer agreement does the same for physical samples. HR and IT must know where people with privileged access actually live and work. The privacy office cannot answer those questions alone.

What an organization must prove after October 2025

From October 6, 2025, organizations engaged in restricted transactions needed a written data compliance program. It must include risk-based due diligence, vendor verification, security controls meeting CISA’s requirements, annual independent audits and records. Certain reporting obligations also apply.

The rule contains exemptions, including for some FDA-regulated clinical investigations, for data needed to obtain regulatory approval of drugs and devices, and for certain intra-company transactions. They are narrow and should be confirmed with counsel. Penalties come from the International Emergency Economic Powers Act and can be civil or criminal. That law is the same one that underpins many U.S. economic sanctions, which signals how seriously the government treats the subject.

Proof is not the same as policy

Proof is a different task from policy. A policy says what an organization intends to do; proof shows that it did it. An auditor will want to see the data map and the list of vendors and personnel with access to covered data. It will want the diligence performed on each, and evidence that CISA’s controls, such as data minimization, encryption and access denial for covered persons, are operating.

Data minimization means sharing only the data a task actually needs. Access denial for covered persons means technical controls that stop those individuals from reaching the data at all, rather than relying on a promise not to look.

Contracts need clauses that let the organization verify vendor answers and terminate if ownership changes. A vendor that was U.S.-owned at signing may be acquired; the contract should give the organization the right to find out and to leave.

The hard trade-off

The trade-off is real. Some offshore support and research partnerships will cost more to restructure than to exit, and leaders should make that call with eyes open. Restructuring might mean moving support staff, rebuilding access controls or renegotiating a research collaboration. Exiting might mean losing a capability or a scientific partner. Neither is free, and the choice belongs with senior leadership, not buried in a procurement queue.

Criminal penalties, costly contracts and research at stake

Offshore support desks, round-the-clock engineering teams and foreign research partners, many chosen to save money or advance science, may now have to be restructured or replaced.

Risk. The penalties are not the familiar privacy fines. Because they rest on the International Emergency Economic Powers Act and can be criminal as well as civil, a violation is a national security matter rather than a compliance lapse. That changes how regulators, auditors and the public view it, and it changes the personal exposure of the people who signed off.

Cost. The rule touches arrangements that many organizations chose precisely because they saved money: offshore support, round-the-clock engineering and global research partnerships. Restructuring those relationships, adding controls or replacing a vendor all cost money and time. Leaders need to see those costs early, when they can be planned, rather than after an audit finding.

Research and revenue. For academic medical centers and life sciences firms, data and samples are also scientific currency. Collaborations, data licensing and biobank partnerships can support grants, publications and commercial programs. A rule that prohibits some of those transactions outright, and restricts others, can change which partnerships are worth pursuing.

Reputation and trust. Patients and research participants share their data and samples on trust. Few things would damage that trust faster than a report that a hospital’s genomic data was reachable from a country of concern through a support contract nobody reviewed.

Organization. Most of all, the rule forces a conversation between functions that rarely talk about data together. Procurement negotiates contracts, research administration signs collaboration agreements, HR hires staff and IT grants access, each in its own system. The rule asks them to answer one shared question, and only senior leadership can make sure they do.

How it shows up inside a working organization

Day to day, compliance with this rule looks less like a new department and more like a few new questions inserted into existing workflows. The vendor onboarding form gains questions about ownership, staff location and subcontractors. The research agreement checklist gains a step for foreign counterparties and onward transfer. The access request process for data platforms gains a check on where the requester is primarily resident. The data map gets refreshed on a set schedule, so the twelve-month counts stay current.

Each of those steps is small. Together they create the evidence trail that the October 2025 requirements call for, without asking any one function to carry the whole load.

Putting it into practice: sequencing and ownership

Sequencing helps. The first audit cycle should start where prohibited transactions are possible, such as any licensing of genomic or biospecimen data abroad, because those cannot be cured with security controls. Next come restricted relationships involving the largest data sets and the broadest access, typically offshore engineering and support for clinical data platforms. Smaller vendor contracts can follow in the normal renewal cycle, with standard clauses added as each comes up. That order puts limited legal and procurement time where a violation would be hardest to defend.

At an academic medical center, that sequence might look like this. In the first month, research administration lists every agreement that licenses or ships genomic data or samples outside the United States, and counsel reviews each one. In the next two months, procurement and IT identify the vendors with access to the largest clinical and claims data sets, ask where their privileged staff are located, and confirm CISA’s controls. Over the following year, every contract that comes up for renewal gets standard clauses on ownership, staff location, verification and termination.

The goal is a short set of artifacts that can be handed to an auditor: the data map; a register of vendors, partners and staff with access to covered data; the diligence file for each; evidence of controls; and the contract clauses. The usual errors are assuming de-identified data is exempt, treating small genomic studies as below the threshold without counting, asking vendors where their servers are rather than where their people are, and leaving the whole matter to the privacy office.

Where an organization’s exposure sits

1. Do we have a data map showing, for each major data set, its categories, how many U.S. persons it covered in the past year and whether it is shared outside the organization, without assuming de-identified or encrypted data is out of scope?
2. Which of our data sets include genomic data, how close are they to the 100-person threshold, and has counsel reviewed every arrangement that licenses, sells or ships genomic data or biospecimens abroad?
3. For each vendor with access to sensitive data, do we know who owns it, where its staff with access are located and which subcontractors it uses, and does anyone with administrator rights over our data platforms live or work in a country of concern?
4. Do our contracts let us verify vendor answers and terminate if ownership changes, and do our research agreements with foreign counterparties include onward-transfer terms?
5. Can we show an auditor that CISA’s security requirements are operating for every restricted transaction, and who decides which relationships would cost more to restructure than to exit?

With hindsight

The October 6, 2025 milestone arrived as scheduled, and organizations with restricted transactions needed their compliance programs, diligence and audit arrangements in place. The department continued to issue guidance and answers to frequently asked questions. For many health systems, that meant the work begun after the grace period ended had to become a standing program, with owners, records and a yearly audit.

The rule also proved to be one strand of a broader federal posture on biotechnology and foreign access. NIH had already moved in April 2025 to block access to its controlled-access research data repositories from countries of concern. Controlled-access repositories are the databases where NIH holds sensitive research data, such as genomic data, that approved researchers may use under conditions.

In Congress, the BIOSECURE Act took aim at the same concern from the procurement side, seeking to restrict federal reliance on biotechnology providers designated as companies of concern. Where the Data Security Program looks at who can reach data, BIOSECURE looked at whom the government buys from.

Taken together, these moves point in one direction. For research institutions and life sciences firms, ownership and personnel location have joined encryption and access control as standing diligence questions. A partner’s security posture is no longer the whole story; its ownership, its workforce and its own suppliers are part of the risk.

The consequences are practical. Vendor selection, research partnerships and hiring decisions now carry a national security dimension that boards may not have considered. The organizations best placed are those that treat reach as a routine question at the start of every relationship, rather than a special review triggered by a headline. Asking those questions at signing is far cheaper than unwinding a partnership after it has grown, staffed up and become part of how the organization works. Organizations should track both regimes with counsel.