DOJ Data Security Program and medical billing: when a vendor’s access to bulk health data is restricted

• A foreign entity organized under the laws of, or with its principal place of business in, a country of concern.
• A foreign entity owned 50% or more, directly or indirectly, by a country of concern or by another covered person.
• A foreign individual who is an employee or contractor of a country of concern or of a covered-person entity.
• A foreign individual primarily resident in a country of concern.
• Any person the Attorney General designates as owned, controlled or directed by, or acting for, a country of concern or covered person.

The first four apply automatically, so a name search is not enough (28 CFR 202.211; DOJ FAQ). A citizen of a country of concern who lives in the United States is a U.S. person, and a citizen who lives in a third country is not covered by nationality alone. When a vendor is itself a covered person, its foreign-person employees are covered persons too (DOJ compliance guide).

• There is no data-localization rule. The trigger is access by a country of concern or covered person, and the rule imposes nothing on transactions that do not involve one (90 FR 1646). A vendor outside the six listed countries is not a covered person because of where it works.
• If a U.S. person contracts with a foreign vendor that is not a covered person, and the vendor gives a covered-person employee access without the U.S. person’s knowledge or direction, neither agreement is a restricted transaction. DOJ does not expect second-level diligence on a foreign vendor’s employment practices absent evasion.
• A U.S. service provider that processes a client’s bulk data and itself employs a covered person with access has a restricted employment agreement, and it has engaged in it knowingly (28 CFR 202.230).
• Hong Kong and Macau are part of China for the rule, so a vendor with its principal place of business there is a covered person.

The regulation text contains no reference to HIPAA, to business associates or to covered entities, and no exemption turns on HIPAA status or on a business associate agreement. DOJ says the personal health data definition applies to any data that meets it, regardless of the entity that holds it, and that the program is activity-based and does not take an entity-based approach (DOJ FAQ). The exemptions that touch health data are limited to government business, clinical investigations and regulatory authorization uses. The financial services exemption covers payment processing, and the sources read do not say whether DOJ would apply it to medical billing. DOJ declined to create a safe harbor for due diligence practices. The HIPAA guide covers the separate HIPAA duties.

• Who owns the vendor, and is any owner, parent or principal place of business in a listed country?
• Do any employees, contractors or subcontractors with access to our data live in a listed country?
• Which of our systems and how many patient records can each person reach, and over what period?
• How are keys held and access controlled so that unencrypted data stays out of reach?
• What does the contract say if the vendor or a subcontractor becomes a covered person?

The state, payer and Medicaid rules that sit alongside this one are on the offshore medical billing restrictions page, the contract terms are on the business associate agreement page, and the question list is in offshore medical billing vendor questions. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.