On Feb. 28, 2024, President Biden issued an executive order to protect sensitive personal data from exploitation by “countries of concern”. The order calls for actions that will likely lead to the development of regulations to shift how domestic health companies and insurers store and transmit data. Regulations will have to be drafted and go through a public comment period, providing opportunity for stakeholder engagement.

The order requires the Department of Justice (DOJ) to issue regulations that establish clear protections for Americans’ sensitive personal data from access and exploitation. These protections will extend to genomic data, biometric data, personal health data, geolocation data, financial data, and certain kinds of personal identifiers. This effort is intended to prevent the large-scale transfer of that data to countries of concern that have a track record of collecting and misusing data on Americans.

The Departments of Health and Human Services, Defense, and Veterans Affairs are to ensure that federal grants, contracts, and awards are not used to facilitate access to sensitive health data by countries of concern, including through companies located in the U.S.

DOJ and the Department of Homeland Security are to work together to set high security standards to prevent access by certain countries to Americans’ data through other commercial means, such as data available via investment, vendor, and employment relationships.

The executive order states that these activities do not stop the flow of information necessary for financial services activities or impose measures aimed at a broader decoupling of the consumer, economic, scientific, and trade relationship that the U.S. has with other countries.