How the DOJ’s bulk data rule made reach, not storage, the health data test

The week

The Justice Department’s Data Security Program, a final rule issued under Executive Order 14117 and codified at 28 CFR Part 202, took effect on April 8, 2025. It prohibits or restricts transactions that could give countries of concern, or covered persons linked to them, access to bulk U.S. sensitive personal data or government-related data. The countries of concern are China, including Hong Kong and Macau, Cuba, Iran, North Korea, Russia and Venezuela. In April, the department announced a limited enforcement policy for the first 90 days, through July 8, 2025, for organizations making good-faith efforts to comply. It also published a compliance guide and answers to frequently asked questions. Full enforcement applied after July 8. Due diligence, audit and reporting requirements followed on October 6, 2025.

Health systems and life sciences companies judge data risk through HIPAA, the Common Rule, state privacy laws and, abroad, the GDPR. All of them ask whether data is protected and used for permitted purposes. The Data Security Program asks a different question: could certain foreign parties gain access to the data in bulk through a commercial relationship? It works more like export control than privacy law. That shifts the work away from the privacy office toward the functions that create relationships: procurement, research administration and human resources. We take the rule in three parts: which data is in scope, which relationships create access, and what an organization must be able to prove after October 2025.

Which data is in scope

The rule covers six categories of sensitive personal data held in bulk: human genomic and other omic data, biometric identifiers, precise geolocation data, personal health data, personal financial data and certain covered personal identifiers. Each has a threshold counted over twelve months. Human genomic data is in scope above 100 U.S. persons, and other human omic data above 1,000. Personal health and financial data are in scope above 10,000 U.S. persons. Government-related data, such as data linked to current or recent federal personnel, is covered at any volume.

Two features catch healthcare organizations out. First, the rule counts data even when it has been anonymized, pseudonymized, de-identified or encrypted. A data set released under HIPAA’s de-identification standard can still be covered data. Second, the genomic threshold is low enough that a single sequencing study, biobank extract or rare-disease registry can cross it. A research institute that treats its genomic collaborations as small because each involves a few hundred participants may be wrong under this rule.

The first practical task is a data map that records, for each major data set, its categories, the number of U.S. persons over the past year and whether it is shared outside the organization. Few health systems have that view, because no earlier rule required counting people across data sets this way.

Which relationships create access

The rule prohibits two kinds of transaction with countries of concern or covered persons: data brokerage, meaning the sale or licensing of access to covered data, and any transaction giving access to bulk human omic data or the biospecimens from which it could be derived. It restricts three others, which are allowed only if security requirements set by CISA are met: vendor agreements, employment agreements and investment agreements.

The restricted categories are where most healthcare exposure sits, and they turn on people as much as companies. Covered persons include entities owned 50 percent or more by a country of concern, and individuals primarily resident in one. A U.S. analytics vendor whose support engineers in Shanghai can query a hospital’s claims warehouse may bring an ordinary services contract into scope. So can hiring a contractor in a country of concern with administrator rights over a research data platform. Onward transfer matters too. An organization that licenses covered data to a foreign party outside the countries of concern must include contract terms barring onward transfer to them, and report known violations.

This is why ownership falls to procurement, research administration and HR. Procurement must ask vendors about ownership, the location of staff with data access and subcontractors. Research administration must review data use and material transfer agreements for foreign counterparties. HR and IT must know where people with privileged access actually live and work. The privacy office cannot answer those questions alone.

What an organization must prove after October 2025

From October 6, 2025, organizations engaged in restricted transactions needed a written data compliance program. It must include risk-based due diligence, vendor verification, security controls meeting CISA’s requirements, annual independent audits and records. Certain reporting obligations also apply. The rule contains exemptions, including for some FDA-regulated clinical investigations, for data needed to obtain regulatory approval of drugs and devices, and for certain intra-company transactions. They are narrow and should be confirmed with counsel. Penalties come from the International Emergency Economic Powers Act and can be civil or criminal.

Proof is a different task from policy. An auditor will want to see the data map and the list of vendors and personnel with access to covered data. It will want the diligence performed on each, and evidence that CISA’s controls, such as data minimization, encryption and access denial for covered persons, are operating. Contracts need clauses that let the organization verify vendor answers and terminate if ownership changes. The trade-off is real. Some offshore support and research partnerships will cost more to restructure than to exit, and leaders should make that call with eyes open.

Sequencing helps. The first audit cycle should start where prohibited transactions are possible, such as any licensing of genomic or biospecimen data abroad, because those cannot be cured with security controls. Next come restricted relationships involving the largest data sets and the broadest access, typically offshore engineering and support for clinical data platforms. Smaller vendor contracts can follow in the normal renewal cycle, with standard clauses added as each comes up. That order puts limited legal and procurement time where a violation would be hardest to defend.

With hindsight

The October 6, 2025 milestone arrived as scheduled, and organizations with restricted transactions needed their compliance programs, diligence and audit arrangements in place. The department continued to issue guidance and answers to frequently asked questions.

The rule also proved to be one strand of a broader federal posture on biotechnology and foreign access. NIH had already moved in April 2025 to block access to its controlled-access research data repositories from countries of concern. In December 2025, the annual defense authorization act included a version of the BIOSECURE Act. It restricts federal agencies, and companies using federal contracts or grants, from relying on biotechnology providers designated as companies of concern. Its initial designation list is due by late 2026. For research institutions and life sciences firms, ownership and personnel location have joined encryption and access control as standing diligence questions. Organizations should track both regimes with counsel.