To the surprise of few, healthcare and life sciences organizations already operate under many complex and competing frameworks within the data privacy space, from HIPAA to a rapidly shifting patchwork of state consumer health data laws. A new player has arrived on the scene and is making a splash: the U.S. Department of Justice's Data Security Program (the “Program”), also commonly called the DOJ Bulk Data Transfer Rule (28 C.F.R. Part 202).
The Rule Itself
Effective as of April 2025 and enforced by the DOJ's National Security Division since July 2025, the Bulk Data Transfer Rule (the “Rule”) treats certain cross-border data flows as a national security concern rather than a strictly privacy-focused one. The Rule implements Executive Order 14117, which was issued by former U.S. President Joe Biden and has been implemented by the current administration of U.S. President Donald Trump, and restricts or prohibits transactions that would provide designated foreign actors access to Americans' bulk sensitive personal data or U.S. government-related data. For purposes of the Rule, the DOJ has identified six countries of particular concern:
The Rule also applies to "covered persons," which include entities and individuals connected to the aforementioned countries, along with anyone the DOJ designates on its Covered Persons List. With regard to the latter, the names of designated covered persons are published in the Federal Register and added to the National Security Division's Covered Persons List.
Notably, in contrast to HIPAA, the Rule applies regardless of whether the data has been anonymized, pseudonymized, de-identified, or encrypted. In other words, de-identification under the HIPAA Privacy Rule does not automatically exempt data from the DOJ’s scope.
Healthcare and Life Sciences Entities
The Rule applies to six categories of sensitive personal data, several of which are central to healthcare and life sciences: covered personal identifiers, precise geolocation, biometric identifiers, human 'omic data, personal health data, and personal financial data. The categories most relevant to healthcare and life sciences carry the following bulk thresholds, measured over a rolling twelve-month period:
* Other human 'omic data includes epigenomic data (how genes are chemically modified), proteomic data (the proteins the body makes), and transcriptomic data (which genes are transcriptionally active and how strongly).
Several observations stand out about these thresholds. The numerical counts run on a rolling twelve-month basis and aggregate across multiple transactions with the same counterparty. Hence, a transaction can be covered regardless of whether the threshold is reached in a single transfer or built up through a string of smaller ones. Human genomic data has the lowest threshold in the whole program, counts as "bulk" once it covers just 100 U.S. people, and is thus the most easily triggered. Human biospecimens, meaning physical samples like blood or tissue from which bulk 'omic data could be extracted, fall under the program regardless of quantity, so the biospecimen itself can trigger coverage before any data has been generated.
In addition to outright sales of data, the Rule applies to vendor agreements, employment agreements, and investment agreements, meaning that many routine arrangements can fall within the rule’s scope, including offshore IT support, cloud hosting, data analytics vendors, and foreign employees or contractors who can access covered data. Given how common these services are in clinical research and health technology, many organizations that do not ordinarily view themselves as data brokers can still fall within the Rule’s scope, including:
Enforcement and Exposure
Prohibited transactions are barred outright. Restricted transactions are permitted only if the U.S. person satisfies the published security requirements from the Cybersecurity and Infrastructure Security Agency (CISA) and referenced in the Program and also abides by associated due diligence, audit, and recordkeeping obligations. Violations carry both civil and criminal penalties. In addition, companies are increasingly being sued by private individuals, including in class actions, under wiretapping and privacy laws such as the Electronic Communications Privacy Act. The due diligence, audit, and reporting duties for restricted transactions took effect in October 2025, meaning the compliance window has already closed.
The life sciences sector faces added scrutiny. The clinical investigation and post-marketing surveillance data exemption at Section 202.511 has drawn attention, though sponsors invoking it for foreign data handling should not assume it will be interpreted broadly. There is a companion exemption for regulatory approval at Section 202.510 that covers data necessary to obtain or maintain authorization to research or market a drug, biological product, or device. Both exemptions are narrow and only lift the prohibitions and restrictions in subparts C, D, J, and K. This means that recordkeeping and reporting duties remain in effect, limiting exemptions for a transaction strictly to what is necessary for clinical or regulatory purposes.
First Steps
To comply with the Rule, mapping where covered data is collected and stored should be the first step, followed by figuring out which vendors, contractors, investors, and employees could provide a country of concern or covered person access to it. Thereafter, check if existing contracts include the data security and prohibition language as required under the rule. Companies with international clinical trials or genomic research should take these steps sooner than later, given that the 'omic thresholds are so low and easily triggerable.
The DOJ has published a Compliance Guide and a set of Frequently Asked Questions that pertain to many implementation-related questions. Because the Program works like an export control layered on top of existing privacy laws, national security analysis should be coordinated directly with HIPAA and state privacy compliance officers to maximize efficiency.
Disclaimer: This industry insight is for general information only, is not legal advice, and does not create an attorney-client relationship.