- within Insurance and Corporate/Commercial Law topic(s)
On September 24, 2025, the National Institutes of Health ("NIH") published a policy entitled "Enhancing Security Measures for Human Biospecimens" (the "Policy"). The Policy is based on Executive Order 14117, "Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern" (the "EO") and places new restrictions on entities that hold human biospecimens of U.S. persons collected, obtained, stored, used, or distributed using on-going or new NIH funds. Subject to only limited exceptions, the Policy, which takes effect on October 24, 2025, prohibits the sharing of such biospecimens, directly or indirectly, with institutions or parties located in the People's Republic of China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Venezuela ("Countries of Concern").
Background
The EO, which was issued by then President Biden in February 2024, directed the U.S. Department of Justice ("DOJ") to conduct rulemaking that resulted in the final rule entitled "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," 28 C.F.R. Part 202, which took effect on April 8, 2025 and is now referred to by the DOJ as the "Data Security Program" (the "DSP"). The DSP prohibits U.S. persons from knowingly engaging in certain data transactions with a Country of Concern or covered person that involves access by that Country of Concern or covered person to bulk U.S. sensitive personal data that involves, among other things, bulk human 'omic data as well as human biospecimens from which bulk human 'omic data can be derived.1 The DSP set the bulk threshold for such data and biospecimens at more than 1,000 U.S. persons or, in the case of human genomic data, at more than 100 U.S. persons. Ropes & Gray published alerts on the DSP and DOJ guidance on the DSP.
The DSP contains an exemption for "Official Business of the U.S. Government" that exempts much federally funded research, such as research funded by NIH grants, from many elements of the DSP. The rationale for this exemption is to avoid activities being subjected simultaneously to restrictions of multiple federal agencies, given that the EO directed the Secretary of Defense, the Secretary of Health and Human Services, the Secretary of Veterans Affairs, and the Director of the National Science Foundation to consider issuing regulations, guidance, or orders to prohibit the provision of assistance that enables access by Countries of Concern or covered persons to United States persons' bulk sensitive personal data. The EO also directed those same agencies to develop and publish guidance to assist United States research entities in ensuring protection of their bulk sensitive personal data.
NIH Policy
Relying on the EO, the NIH published the Policy, which "applies to all human clinical and research biospecimens obtained from U.S. persons (regardless of identifiability) that are collected, obtained, stored, used, or distributed and that are supported or funded by any on-going or new NIH funding mechanisms (grants, cooperative agreements, contracts, Other Transactions, and intramural support) regardless of NIH funding level." As noted above, the Policy prohibits the sharing of such biospecimens, directly or indirectly, with institutions or parties located in Countries of Concern. Unlike the DSP, the Policy does not contain any bulk threshold, and thus sharing of even a single biospecimen covered by the Policy with a Country of Concern is prohibited, unless an exemption is satisfied.
The Policy outlines three exceptions to the prohibition that allow human biospecimens to be shared or distributed to Countries of Concern only if use of the human biospecimens is:
- To meet transactions required or authorized by federal law or international agreements, as outlined at 28 C.F.R. § 202.507, including global health, or necessary for compliance with federal law; or
- Needed in rare and compelling circumstances where the facility and personnel in the Country of Concern possess needed capabilities and/or expertise not available elsewhere, the use of the biospecimen cannot be delayed to a time when capability and/or expertise is available elsewhere, and done with the consent of the individual from whom the biospecimen was collected; or
- At the request of the individual whose biospecimen was collected, obtained, or stored using NIH funds; for purposes of diagnosis, prevention or treatment of that individual; and in compliance with applicable federal laws, regulations, and policies.
If an entity takes advantage of one of the above exceptions, the Policy requires the entity to retain documentation related to the sharing or distributing of the human biospecimens, including the quantity and content of the biospecimen material that was shared or distributed. The Policy also states that it does not apply to "cell derivative products or cell lines derived from human biospecimens of U.S. persons collected, obtained, stored, used, or distributed using on-going or new NIH funds that are commercially or publicly available prior to the effective date of this policy.
It is important for entities that have been building compliance programs for the DSP to note that if they are taking advantage of the DSP's exemption for "Official Business of the U.S. Government,"2 they will no longer be able to rely on such exemption with respect to biospecimens that are subject to the Policy. In addition, the Policy will prevent reliance on other exemptions in the DSP, such as the exemption for "[o]ther clinical investigations and post-marketing surveillance data,"3 for biospecimens that fall within the scope of the Policy. Also of note, the Policy does not appear to limit its applicability to federal awardees but, rather, states that the restrictions apply to human biospecimens of U.S. persons that are collected, obtained, stored, used, or distributed using ongoing or new NIH funds. Thus, the Policy would appear to apply to human biospecimens of U.S. persons that are held not just by entities that are themselves NIH awardees or sub-awardees, but also to any entity obtaining, storing, using or distributing biospecimens if such biospecimens were originally collected with NIH funding. Entities will thus need to track the source of their biospecimens and whether any such biospecimens were collected, obtained, stored, used, or distributed using ongoing or new NIH funds.
The Trump Administration continues to focus on restricting transfers of sensitive personal data and biospecimens to Countries of Concern. The Policy is the latest action building off the EO and the DSP, and it likely will not be the last. Entities should watch for additional guidance to issue from federal departments and agencies that fund research and other activities, and should consider whether they may need to restructure their operations to limit flows of biospecimens and sensitive data to Countries of Concern.
Footnotes
1. 28 C.F.R. § 202.303.
2. 28 C.F.R. § 202.504.
3. 28 C.F.R. § 202.511.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
