New obstacles for health care: Federal and state national security regulations increasingly target health data | IAPP
Summary
Federal and state regulations to prevent foreign adversary access to U.S. health and genomic data have expanded into a multilayered framework over the past three years. The DOJ’s Preventing Access to Americans Bulk Sensitive Personal Data rule (effective April 8, enforceable Oct 6, 2025) and state laws such as Florida’s EHR exchange law impose data localization, access restrictions, and long-term recordkeeping. Life sciences firms, clinical labs, telehealth platforms and consumer health brands must now manage overlapping obligations, implement written compliance programs, and allocate internal resources to meet due diligence, auditing and risk-review requirements. The regimes remain largely unaligned across jurisdictions, increasing operational and legal complexity for companies that store, process or host sensitive health data.