DOJ's Bulk Sensitive Data Transfer Rule: Key Insights for Health Care Compliance
Summary
Epstein Becker Green analyzes the U.S. Department of Justice's Bulk Sensitive Data (BSD) Transfer Rule, which imposes compliance obligations on healthcare and life sciences organizations that transfer or provide access to sensitive data, including genomic information. The rule applies when data on as few as 100 individuals is shared, catching many organizations unprepared. The BSD Transfer Rule creates obligations that extend beyond HIPAA, applying even to de-identified or anonymized data, and covers any access by foreign vendors, board members, or investors—not only formal data-sharing agreements.
What changed
This article summarizes the DOJ's Bulk Sensitive Data Transfer Rule, which establishes new compliance obligations for healthcare and life sciences organizations that transfer or provide access to sensitive data, particularly genomic information. The rule applies at surprisingly low thresholds—sharing data on just 100 individuals can trigger compliance requirements—and extends beyond HIPAA by covering de-identified or anonymized data as well.
Healthcare compliance teams should assess whether their data-sharing practices fall under the BSD Transfer Rule, particularly arrangements that give foreign vendors, board members, or investors the ability to view sensitive data, even without a formal transfer agreement. Organizations should review their data access policies and vendor relationships to determine if they are subject to these new requirements.
Archived snapshot
Apr 16, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
April 16, 2026
DOJ’s Bulk Sensitive Data Transfer Rule: Key Insights for Health Care Compliance Teams – Diagnosing Health Care
Epstein Becker & Green + Follow Contact LinkedIn Facebook X Send Embed What health care and life sciences organizations need to know:
• “Bulk” Has a New Definition: The volume thresholds under the U.S. Department of Justice’s (DOJ’s) Bulk Sensitive Data (BSD) Transfer Rule are surprisingly low—sharing genomic data on just 100 people can trigger compliance requirements, catching many organizations off guard.
• HIPAA See more +
What health care and life sciences organizations need to know:
• “Bulk” Has a New Definition: The volume thresholds under the U.S. Department of Justice’s (DOJ’s) Bulk Sensitive Data (BSD) Transfer Rule are surprisingly low—sharing genomic data on just 100 people can trigger compliance requirements, catching many organizations off guard.
• HIPAA Compliance Is Not Enough: The BSD Transfer Rule creates an entirely new compliance layer that goes beyond existing privacy frameworks, such as the Health Insurance Portability and Accountability Act (HIPAA), applying even when data has been de-identified or anonymized.
• It’s About Access, Not Just Transfers: Simply giving a foreign vendor, board member, or investor the ability to view sensitive data can trigger the BSD Transfer Rule—no formal data-sharing agreement is required.
In this episode of Diagnosing Health Care®, Epstein Becker Green attorneys Laura DePonio, Elizabeth McEvoy, and Elena Quattrone walk health care and life sciences organizations through the DOJ’s BSD Transfer Rule—from scoping and compliance to enforcement risks and exemptions.
Navigate BSD Transfer Rule Compliance with Confidence:
Our team has developed specific tools and advisory services to help organizations like yours understand their obligations under the BSD Transfer Rule, assess risk, and implement compliant data practices. Check out our free resource center:
https://explore.ebglaw.com/resources/doj-bulk-sensitive-data-transfer-rule/
The Diagnosing Health Care video podcast series examines the business opportunities and solutions that exist despite the high-stakes legal, policy, and regulatory issues that the health care industry faces. Sign up for email notifications and subscribe on your favorite podcast platform: https://www.ebglaw.com/dhc93 See less -
Controls: true
Embed Copy Send Report
Related Posts
- The DOJ’s Bulk Sensitive Data Rule and Your Obligation to “Know Your Vendor”
- The Down-Low on Data for Value-Based Enterprises and Their Participating Providers – Diagnosing Health Care Video Podcast Video
- The DOJ’s Bulk Sensitive Data Rule and Your Obligation to “Know Your Data”
- 42 CFR Part 2 Final Rule: What’s Changing and What Do You Need to Know? – Diagnosing Health Care Video Podcast Video
Can Food Really Be Medicine? Transforming Health Care One Bite at a Time – Diagnosing Health Care Video Podcast Video
See more
Other MultiMedia by Epstein Becker & Green
401(k) Alternative Assets, NLRB Removal Protections, and Military Leave Requests - Employment Law This Week®
-
Employer AI Headaches: Job Postings, Client Privilege, and Microchip Bans - Employment Law This Week®
-
Is Cemex Still Valid? Sixth Circuit Creates Uncertainty - Employment Law This Week®
-
Non-Competes in 2026: FTC Signals Major Policy Shift - Employment Law This Week® - Spilling Secrets Podcast
-
State AGs in Action: Health Care Enforcement in 2026 – Speaking of Litigation Video Podcast
-
NLRB Shifts Enforcement, DOL’s Non-Union Focus, and EEOC’s DEI Crackdown - #WorkforceWednesday® - Employment Law This Week®
-
NLRB and DOL Take Action on Joint Employer and Independent Contractor Rules - #WorkforceWednesday® - Employment Law This Week®
-
NYC Enforcement Blitz, CA Surveillance Pricing, and PA Criminal History Rule Update - #WorkforceWednesday® - Employment Law This Week®
-
How to Respond to Employee Concerns About ICE Investigations - #WorkforceWednesday® - Employment Law This Week®
-
Dov Lutzker Connects the Dots Between ADA Rules and Real-World Solutions
-
What Do Federal DEI Crackdowns Mean for Employers? - #WorkforceWednesday® - Employment Law This Week®
-
DOL Compliance Tools & PBM Regulation, NLRB Intake Updates - #WorkforceWednesday® - Employment Law This Week®
-
Remote Work and Disability Discrimination: What Employers Need to Know - #WorkforceWednesday® - Employment Law This Week®
-
“Stay or Pay” Agreements, Developing Immigration News, EEOC Power Shift - #WorkforceWednesday® - Employment Law This Week®
-
How Jonathan Brenner Delivers Creative Legal Solutions for California Employers
-
FMLA and FLSA Compliance in 2026—New DOL Opinion Letters and Emerging Risks - #WorkforceWednesday® - Employment Law This Week®
-
Employment Law in 2026: What to Expect - #WorkforceWednesday® - Employment Law This Week®
-
Top Employment Law Changes of 2025 - #WorkforceWednesday® - Employment Law This Week®
-
The Down-Low on Data for Value-Based Enterprises and Their Participating Providers – Diagnosing Health Care Video Podcast
DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.
©
Epstein Becker & Green
Written by:
Epstein Becker & Green Contact + Follow more less
PUBLISH YOUR CONTENT ON JD SUPRA
- ✔ Increased readership
- ✔ Actionable analytics
- ✔ Ongoing writing guidance Join more than 70,000 authors publishing their insights on JD Supra
Published In:
Health + Follow Intellectual Property + Follow International Trade + Follow Privacy + Follow Science, Computers & Technology + Follow more less
Epstein Becker & Green on:
"My best business intelligence, in one easy email…"
Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra: Sign Up Log in ** By using the service, you signify your acceptance of JD Supra's Privacy Policy.* - hide - hide
Related changes
Get daily alerts for JD Supra Healthcare
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from EBG.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when JD Supra Healthcare publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.