DOJ Bulk Data Rule and Genomic Data: What Genetic Testing Labs Must Know in 2026
Short answer: Yes. DOJ's bulk data rule, 28 CFR Part 202, covers labs sharing human genomic data on more than 100 U.S. persons with China, five other countries of concern, or entities they control. Some transfers are prohibited; others need security controls, annual audits, and records. Labs should map data flows and vendor access now.
Why this rule matters to a lab, not just a pharma sponsor
Most commentary on the DOJ Data Security Program targets drugmakers and clinical trial sponsors. But the rule is written around data, not industry. Morgan Lewis, in a July 15, 2026 analysis for life sciences companies, describes 28 CFR Part 202, published at 90 Fed. Reg. 1636 on January 8, 2025 and implementing Executive Order 14117, as covering any U.S. person that engages in a covered data transaction. A molecular lab holding sequence data is squarely a holder of the data type the rule treats most strictly.
The threshold is the reason. Baker Donelson's summary lists the bulk thresholds over a rolling 12-month period: more than 100 U.S. persons for human genomic data, more than 1,000 for epigenomic, proteomic, and transcriptomic data and for biometric identifiers, and more than 10,000 for personal health data. A lab that sequences a few hundred patients a year can cross the genomic line without trying.
Who counts as a country of concern
According to Baker Donelson, the countries of concern are China (including Hong Kong and Macau), North Korea, Cuba, Russia, Iran, and Venezuela. A "covered person" is an entity or individual subject to the ownership, direction, jurisdiction, or control of one of those countries, or one designated by DOJ. For labs, the practical issue is rarely a direct sale. It is an offshore sequencing partner, a software vendor with overseas engineers, a cloud arrangement, or a research collaborator whose ownership you have not checked.
Prohibited versus restricted transactions
Morgan Lewis explains that the rule sorts covered data transactions into two tracks. Data brokerage with a country of concern or covered person, and any covered transaction giving them access to bulk human omic data or the biospecimens from which it could be derived, is prohibited outright under 28 CFR 202.301 to 202.303, and security measures do not cure it. Transactions under vendor, employment, or investment agreements are restricted: they may proceed only if the U.S. person implements CISA security requirements and meets due diligence, audit, reporting, and recordkeeping obligations under 28 CFR 202.401. A restricted transaction without those safeguards is treated as prohibited.
Two details catch labs off guard. First, Morgan Lewis notes that the rule does not exempt anonymized, pseudonymized, de-identified, or encrypted data (28 CFR 202.206), so stripping identifiers from a sequence file does not take it out of scope. Second, Baker Donelson reports that data brokerage with any foreign person involving bulk U.S. sensitive data requires a contract barring onward transfers to countries of concern or covered persons, plus reporting of known or suspected violations within 14 days.
Dates that already passed
This is not a future deadline. Baker Donelson reports the rule took effect April 8, 2025 and the limited enforcement period ended July 8, 2025. Morgan Lewis adds that due diligence and audit requirements took effect October 6, 2025, and that annual reports for certain restricted transactions involving cloud-computing services were due March 1, 2026.
Exemptions are narrower than they look
The rule includes exemptions for federally funded research, FDA-regulated clinical investigations, post-marketing surveillance, and certain drug, biologic, and device authorizations, per both law-firm summaries. Morgan Lewis stresses that the clinical investigation exemption is narrowly construed and does not cover standalone exploratory biomarker research or unrelated commercial use. Neither source reviewed here addresses whether ordinary clinical testing, payment, or billing workflows are exempt, so a lab should not assume that a clinical-care purpose settles the question. Confirm the analysis for each data flow with qualified counsel.
Penalties and enforcement signals
Morgan Lewis reports civil penalties under IEEPA of up to $377,700 (inflation-adjusted) or twice the transaction value, plus potential criminal liability. It also notes that DOJ's September 2025 FAQ update created a process for reporting violations, with whistleblower financial incentives. Beyond DOJ, plaintiffs have begun citing alleged violations as predicates for wiretap claims, and on June 16, 2026 a court in Baker v. Index Exchange allowed such a claim to proceed past the pleading stage. In late June 2026, the House Select Committee on the CCP sent inquiry letters to five pharmaceutical companies about China clinical trials, which Morgan Lewis describes as investigatory rather than punitive. None of these involve genetic testing labs directly, but they show scrutiny of genomic data flows is active.
What labs and RCM teams should do
Start with a data map. List every system, vendor, and collaborator that touches sequence files, variant data, or stored specimens, and note where each is owned, hosted, and staffed. Second, run the threshold test: count the U.S. persons whose genomic data went to any one counterparty in the last 12 months. Third, review vendor and research contracts for onward-transfer limits and covered-person representations. Fourth, if you have any restricted transaction, build the annual audit and the 10-year record file Morgan Lewis describes. Fifth, align this work with your other compliance programs; our guides on CMS lab payment suspensions and the Enhancing CLIA Act cover the billing and quality sides, while our FDA LDT status explainer covers device oversight. Revenue-cycle teams should also confirm that billing and denial-management vendors with offshore staff do not receive genomic files; our denial-prevention guide shows what documentation a payer actually needs, which is usually far less than a full sequence file. For teams evaluating workflow tools, see the ScreenMyGene homepage.
FAQ
Does the DOJ bulk data rule apply to a small genetic testing lab?
It can. The genomic threshold is more than 100 U.S. persons in a 12-month period, so even a small lab may qualify. The rule applies only when a covered data transaction involves a country of concern or covered person. A lab with no such vendors or partners may have little exposure but should document that conclusion.
Which countries are countries of concern?
Baker Donelson lists China, including Hong Kong and Macau, North Korea, Cuba, Russia, Iran, and Venezuela. Covered persons also include entities owned, directed, or controlled by those countries, or designated by DOJ. Labs should screen vendors and collaborators for ownership and control, not just location.
Does de-identifying genomic data take it outside the rule?
No. Morgan Lewis states that the rule does not exempt anonymized, pseudonymized, de-identified, or encrypted data under 28 CFR 202.206. Labs cannot rely on removing patient identifiers to avoid the thresholds or the prohibitions on access to bulk human omic data.
What is the difference between prohibited and restricted transactions?
Prohibited transactions, such as data brokerage or access to bulk omic data by a covered person, cannot proceed. Restricted transactions, such as vendor or employment agreements, can proceed only with CISA security requirements, due diligence, annual audit, reporting, and recordkeeping. Missing the safeguards makes a restricted deal prohibited.
What are the penalties for violations?
Morgan Lewis reports IEEPA civil penalties of up to $377,700 (inflation-adjusted) or twice the transaction value, plus possible criminal liability. DOJ has also set up a process for reporting violations with whistleblower incentives. Labs should treat vendor data access as a compliance risk, not only an IT question.
This article is provided for general educational and business-decision-support purposes for laboratory, revenue-cycle, and clinical-ordering professionals. It summarizes law-firm analyses as of October 26, 2026 and is not legal, compliance, or reimbursement advice. Requirements and enforcement priorities may change; consult qualified counsel and verify against 28 CFR Part 202 and DOJ National Security Division guidance.
Sources: Morgan Lewis, "DOJ's Bulk Sensitive Personal Data Rule: A Cross-Border Compliance Imperative for the Life Sciences Industry" (July 15, 2026); Baker Donelson, "DOJ Bulk Data Rule: Key Takeaways for Health Care and Life Sciences".