Tag: security

  • DOJ Bulk Data Transfer Rule Brief

    DOJ Bulk Data Transfer Rule Brief

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Authored By: Tasha Mohseni

    Can’t believe we are already through November! As much as this year has gone slow for me, it also feels unbelievably fast…

    As I’ve mentioned in numerous posts, we have endured MANY changes this CY25 that have impacted FY26. Ideally, a central repository would be best to review all regulatory updates (at least in my opinion).

    brown wooden ruler and colored pencils on papers

    For now though, I will do my best to keep up with these changes in this evolving landscape! It truly lifts my spirits to spread knowledge to the research compliance community.

    Did anyone attend CITI Program’s webinar that discussed the DOJ Bulk Data Transfer Rule last month?

    I thought the presentation was fabulous! The speaker was informative and had great slides to explain this rule. If you weren’t able to attend, I’m really glad you’re here! For today’s post let’s learn about DOJ’s Bulk Data Transfer Rule. Specifically, I’d like to touch on:

    • What is this rule?
    • When is the rule effective?
    • Why is this rule necessary?
    • What resources are available to better understand this rule?

    Please note that I will NOT be sharing presentation slides or describing the presentation verbatim. Though it gave me background on this topic, I have spent quite some time researching this rule myself. I always want to provide my readers a comprehensive overview of any topic I write about!

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    1. DOJ Rule Matrix
    2. DOJ Rule Timeline
      1. EO 14117: Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern
      2. CISA Publication: Security Requirements for Restricted Transactions
      3. Key Dates and Actions
    3. DOJ Rule Applicability
      1. Data Types Defined Under the DOJ Rule
        1. Biometric Identifiers
        2. Covered Personal Identifiers
        3. Goverment-related Data
        4. Human Biospecimens
        5. Human’omic Data
        6. Personal Financial Data
        7. Personal Health Data
        8. Precise Geolocation Data
      2. Data Transactions Defined Under the DOJ Rule
        1. Transaction
        2. Exempt Transactions
        3. Prohibited Transactions
        4. Restricted Transactions
      3. Other Important Definitions Under the DOJ Rule
        1. Bulk U.S. Sensitive Personal Data
        2. Covered Data Transaction
          1. Access
          2. Countries of Concern
          3. Covered Person
          4. Data Brokerage
          5. Vendor Agreement
          6. Employee Agreement
          7. Investment Agreement
      4. Piecing it Together: Applying the DOJ Rule

    DOJ Rule Matrix

    The DOJ Rule Matrix provides key highlights of the final rule.

    • In general, this rule prohibits and restricts certain sensitive health, genomic, and personal data transactions with certain countries or persons.
    • This rule heavily relies on understanding definitions to determine appropriate applicability and compliance.
    • The rule was finalized in January 2025 with two effective dates (which will be discussed in the subsequent sections).
    • Each resource listed within the matrix will also be described in the subsequent sections.

    (Back to Contents)

    DOJ Rule Timeline

    The timeline for rule creation and implementation stemmed from EO 14117 in February 2024.

    (Back to Contents)

    CISA Publication: Security Requirements for Restricted Transactions

    • As directed by EO 14117, CISA developed security requirements to apply to classes of restricted transactions identified in the DOJ regulation.
    • The security requirements require that U.S. persons engaging in restricted transactions comply with organizational-, system-, and data-level requirements to prevent covered persons and countries of concern from accessing covered data that is linkable, identifiable, unencrypted, or decryptable using commonly available technology.

    (Back to Contents)

    Key Dates and Actions

    (Back to Contents)

    Now, we have a better background as to why this rule was created. Further, we’ve reviewed supporting publications prior to the issuance of the DOJ rule. In the final section, we will dive into:

    • Key terms that will help us understand when the rule applies
    • Rule applicability

    (Back to Contents)

    Advertisements

    DOJ Rule Applicability

    There are many terms we need to work through prior to applying this rule.

    Data Types Defined Under the DOJ Rule

    Note that “Sensitive Personal Data” will be described in the next section as it is based off many terms.

    Biometric Identifiers

    • Measurable physical characteristics or behaviors used to recognize or verify the identity of an individual, including facial images, voice prints and patterns, retina and iris scans, palm prints and fingerprints, gait, and keyboard usage patterns that are enrolled in a biometric system and the templates created by the system

    Covered Personal Identifiers

    • Any listed identifier:
      • In combination with any other listed identifier; or
      • In combination with other data that is disclosed by a transacting party pursuant to the transaction such that the listed identifier is linked or linkable to other listed identifiers or to other sensitive personal data.
    • There are also several exclusions and examples listed within this term within the rule

    Goverment-related Data

    • Any precise geolocation data, regardless of volume, for any location within any area enumerated on the Government-Related Location Data List in ยงโ€‰202.1401 which the Attorney General has determined poses a heightened risk of being exploited by a country of concern to reveal insights about locations controlled by the Federal Government, including insights about facilities, activities, or populations in those locations, to the detriment of national security, because of the nature of those locations or the personnel who work there; and
    • Any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and Intelligence Community

    Human Biospecimens

    • Means a quantity of tissue, blood, urine, or other human-derived material, including such material classified under any of the following 10-digit Harmonized System-based Schedule B numbers

    Human’omic Data

    • Represents the following human data types:
      • Genomic data
      • Epigenomic data
      • Proteomic data
      • Transcriptomic data
    • Excludes pathogen-specific data embedded in human `omic data sets

    Personal Financial Data

    • Data about an individual’s credit, charge, or debit card, or bank account, including purchases and payment history; data in a bank, credit, or other financial statement, including assets, liabilities, debts, or trades in a securities portfolio; or data in a credit report or in a โ€œconsumer report”

    Personal Health Data

    • Health information that indicates, reveals, or describes the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual.

    Precise Geolocation Data

    • Includes data, whether real-time or historical, that identifies the physical location of an individual or a device with a precision of within 1,000 meters

    (Back to Contents)

    Data Transactions Defined Under the DOJ Rule

    Note that “Covered Data Transaction” will be described in the next section as it is based off many terms.

    Transaction

    • Any acquisition, holding, use, transfer, transportation, exportation of, or dealing in any property in which a foreign country or national thereof has an interest.

    Exempt Transactions

    • A data transaction that is subject to one or more exemptions described in subpart E of this part.
    • This will be described in the last section.

    Prohibited Transactions

    • A data transaction that is subject to one or more exemptions described in subpart C of this part.
    • This will be described in the last section.

    Restricted Transactions

    • A data transaction that is subject to one or more exemptions described in subpart D of this part.
    • This will be described in the last section.

    (Back to Contents)

    Advertisements

    Other Important Definitions Under the DOJ Rule

    Bulk U.S. Sensitive Personal Data

    • As notated in the rule, “bulk” is equivalent to a sensitive personal data threshold.
      • There are seven thresholds:
        • Human `omic data
        • Biometric identifiers
        • Precise geolocation data
        • Personal health data
        • Personal financial data
        • Covered personal identifiers
        • Combination of all data types above

    Covered Data Transaction

    Note that the following terms have been defined:

    • Transaction,
    • Government-related data, and
    • Bulk U.S. sensitive personal data
    Access
    • Logical or physical access, including the ability to obtain, read, copy, decrypt, edit, divert, release, affect, alter the state of, or otherwise view or receive, in any form, including through information systems, information technology systems, cloud-computing platforms, networks, security systems, equipment, or software
      • For purposes of determining whether a transaction is a covered data transaction, access is determined without regard for the application or effect of any security requirements
    Countries of Concern
    • Cuba, Venezuela, Russia, North Korea, China, and Iran are countries of concern
    • From the rule, these are any foreign government that, as determined by the Attorney General with the concurrence of the Secretary of State and the Secretary of Commerce:
      • Has engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons; and
      • Poses a significant risk of exploiting government-related data or bulk U.S. sensitive personal data to the detriment of the national security of the United States or security and safety of U.S. persons
    Covered Person
    • There are five types listed within this definition along with their associated examples within the rule
    • From the webinar, a covered person can be anyone who is from any of the countries of concern (resident, national, official) and also could mean a corporate person/entity from these countries
      • Considering this person’s affiliation is crucial
    Data Brokerage
    • The sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.
    Vendor Agreement
    • Any agreement or arrangement, other than an employment agreement, in which any person provides goods or services to another person, including cloud-computing services, in exchange for payment or other consideration.
    Employee Agreement
    • Any agreement or arrangement in which an individual, other than as an independent contractor, performs work or performs job functions directly for a person in exchange for payment or other consideration, including employment on a board or committee, executive-level arrangements or services, and employment services at an operational level.
    Investment Agreement
    • An agreement or arrangement in which any person, in exchange for payment or other consideration, obtains direct or indirect ownership interests in or rights in relation to:
      • Real estate located in the United States; or
      • A U.S. legal entity.

    (Back to Contents)

    Piecing it Together: Applying the DOJ Rule

    Though this was shared earlier in this post, the following resource is recommended to review to ensure compliance and understanding of this rule: Data Security Program: Compliance Guide

    • In general, you should complete an inventory of your data
      • You should review the type of data in question and where it is being transferred to, so rule applicability can be assessed
    • Subparts C-E are critical in understanding data transactions as some of these data transactions are exempt from this rule
    • The guide and rule itself should be reviewed for specific reporting, record keeping, and auditing requirements

    (Back to Contents)


    I hope this article helped you better understand the DOJ’s Bulk Data Transfer Rule! If you did attend the CITI Program webinar, then this post should have been a nice resource to complement what you learned.

  • Why Ethics Matters: Open FDA Investigation on Alleged Non-Consensual Human Experimentation

    Why Ethics Matters: Open FDA Investigation on Alleged Non-Consensual Human Experimentation

    See: Followup: Open FDA Investigation on Alleged Non-Consensual Human Experimentation

    RD Research Services Current Way of Thinking as of 10/30/25

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    330+ subscribers and counting!

    Authored By: Tasha Mohseni

    It feels so good to be writing, reporting, and sharing my insights with you all again!

    I have a fun fact to share that you may not have known about me. When I was in high school I always thought I would be a journalist. I *almost* wish I pursued that, but I’m glad I didn’t. I only pictured myself as the type of journalist that would be present during a high-stakes car chase. Or maybe even being at the front lines of a natural disaster. Another fun fact about me is that I always wanted to be a blogger. But…I never knew what I would write about. I just knew I wanted to write something meaningful…and useful.

    a woman reporting beside the van

    I had no idea that I could report the type of regulatory updates I do now. Without having gone through what I’ve gone through, I never would have ended up in research compliance. And without this journey, I never would have created this meaning AND useful blog for professionals in our field.

    Speaking of our field, can you think of a recent human research ethics violation? If you know of a recent event, please leave a comment and share a link to promote discussion!

    Leave a Reply

    I tried to think about this some time ago (I want to say last month). Of course I am familiar with the cases that led to the Belmont Report. And I certainly recall some after the Belmont report (e.g., Jesse Gelsinger). Fast forward to last Wednesday. I was browsing Regulations.gov, which is still in operation despite the government shutdown. You can imagine my surprise when I came across the following docket:

    Screenshot from Regulations.gov RE: FDA nonrulemaking docket.

    When I read this, I thought "WHOA!" I couldn't believe my eyes. This sounds to me like a recent human research ethics violation case. Which leads me to today's topic. Today, I'm going to cover this request for an FDA investigation. Specifically, I will:

    • Introduce the case prompting investigation
    • Share my thoughts on which ethical tenets were violated based on the intial petition
    • Review the remaining documents associated with this docket
    • Close the article with my concluding thoughts

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    1. Citizen Petition from Kimberly C. Tanner
    2. Initial Ethical Analysis
      1. Nuremberg Code
      2. Belmont Report
      3. ICH GCP E6(R3)
      4. Declaration of Helsinki
    3. Review of Remaining Documentation within the FDA Docket
      1. The "Good Science" Article
      2. The Legal Dagger
      3. The Coup De Gras
    4. Closing Thoughts

    Citizen Petition from Kimberly C. Tanner

    This can be reviewed under FDA-2025-P-5514-0001.

    In summary, the petition states:

    • The FDA to complete the following actions:
      • Initiate an investigation and oversight review into alleged non-consensual human experimentation and Electroconvulsive Shock Torture (ECST) conducted through the misuse of electrophysiological and neuromodulation technologies
      • Issue a Federal Register notice clarifying that the non-therapeutic use of electroconvulsive shock and electromagnetic neuromodulation devices outside approved research or clinical contexts constitutes a violation of human-subject protections under the Common Rule(45 CFR 46) and FDA device regulations (21 CFR Parts 50 and 56)
      • Review and revoke, where appropriate, device clearances or research exemptions that enable non-consensual human application of electrophysiological stimulation
    • The petition is then backed by the following claims:
      • Alleged ongoing use of electrophysiological stimulation and electromagnetic exposure causing pain, seizure-like events, and neurological harm amounting to Electroconvulsive Shock Torture (ECST)
        • The petitioner has journal records indicating this and is conssistent with electrophysiological stimulation under UN Convention Against Torture and the Istanbul Protocol (2022)
      • ECST is distinct from Electroconvulsive Therapy (ECT) which is a regulated medical treatment
      • Citing federal regulations mentioned above and that human experimentation cannot be performed without consent

    (Back to Contents)

    Initial Ethical Analysis

    I immediately thought of four ethical frameworks once I read the petition.

    I'd like to walk through each of these frameworks and share my analysis as it relates to the case.

    Nuremberg Code

    How does this NOT violate every entry in the Nuremburg Code?

    Though there isn't a reason to walk through each statement one by one, I feel we should. Each statement has its own impact to the case:

    • "The voluntary consent of the human subject is absolutely essential. This means that the person involved should have legal capacity to give consent; should be situated as to be able to exercise free power of choice, without the intervention of any element of force, fraud, deceit, duress, over-reaching, or other ulterior form of constraint or coercion, and should have sufficient knowledge and comprehension of the elements of the subject matter involved as to enable him to make an understanding and enlightened decision. This latter element requires that before the acceptance of an affirmative decision by the experimental subject there should be made known to him the nature, duration, and purpose of the experiment; the method and means by which it is to be conducted; all inconveniences and hazards reasonably to be expected; and the effects upon his health or person which may possibly come from his participation in the experiment.

      The duty and responsibility for ascertaining the quality of the consent rests upon each individual who initiates, directs or engages in the experiment. It is a personal duty and responsibility which may not be delegated to another with impunity."
      • This one is self explanatory as this is one of the claims against the alleged party
    • "The experiment should be such as to yield fruitful results for the good of society, unprocurable by other methods or means of study, and not random and unnecessary in nature."
      • You will see my rationale behind this as I explore the other documents within the investigation. I can assure you this was not based on "good science".
    • "The experiment should be so designed and based on the results of animal experimentation and a knowledge of the natural history of the disease or other problem under study that the anticipated results will justify the performance of the experiment."
      • This doesn't sound applicable based off the files within the docket.
    • "The experiment should be so conducted as to avoid all unnecessary physical and mental suffering and injury."
      • I believe the name of this petition explains enough as to why this statement is in direct violation.
    • "No experiment should be conducted where there is an a priori reason to believe that death or disabling injury will occur; except, perhaps, in those experiments where the experimental physicians also serve as subjects."
      • Again, the docket's title is plenty of explanation for this statement's violation.
    • "The degree of risk to be taken should never exceed that determined by the humanitarian importance of the problem to be solved by the experiment."
      • Self explanatory...
    • "Proper preparations should be made and adequate facilities provided to protect the experimental subject against even remote possibilities of injury disability or death."
      • This relates to the "good sciences" article.
    • "The experiment should be conducted only by scientifically qualified persons. The highest degree of skill and care should be required through all stages of the experiment of those who conduct or engage in the experiment."
      • A blend of being "self explanatory" and "good science".
    • "During the course of the experiment the human subject should be at liberty to bring the experiment to an end if he has reached the physical or mental state where continuation of the experiment seems to him to be impossible."
      • Given that consent was acquired, it's safe to assume that the participant wasn't given any liberties.
    • "During the course of the experiment the scientist in charge must be prepared to terminate the experiment at any stage, if he has probable cause to believe, in the exercise of the good faith, superior skill and careful judgement required by him that a continuation of the experiment is likely to result in injury, disability, or death to the experimental subject."
      • Again, a blend of being "self explanatory" and "good science".

    (Back to Contents)

    Belmont Report

    This can be reviewed here: Belmont Report.

    I immediately saw that this was in direct violation of two out of the three tenets:

    • Respect for Persons
      • Violating informed consent is in direct violation of this principle.
      • Specifically, violating the fact that folks are autonomous agents and that consent must be voluntarily given to be valid.
    • Beneficence
      • Though it is unclear what any benefits would be from this study, potential harms were not minimized.
      • This also ties into violation of the Hippocratic Oath, which is foundational to medical ethics.

    (Back to Contents)

    ICH GCP E6(R3)

    This can be reviewed here: ICH GCP E6(R3).

    Of course, this is under the assumption that this was a clinical trial:

    • "Clinical trials should be conducted in accordance with the ethical principles that have their origin in the Declaration of Helsinki and that are consistent with GCP and applicable regulatory requirement(s). Clinical trials should be designed and conducted in ways that ensure the rights, safety and well-being of participants."
      • I won't dive further into this since I already mentioned the Declaration of Helsinki.
    • "Informed consent is an integral feature of the ethical conduct of a trial. Clinical trial participation should be voluntary and based on a consent process that ensures participants (or their legally acceptable representatives, where applicable) are well-informed."
      • Again, one of the most compelling elements of this case.
    • "Clinical trials should be subject to an independent review by an IRB/IEC."
      • This ties into the "good science" article.
    • For principles 4-11:
      • See bullet point above.

    (Back to Contents)

    Declaration of Helsinki

    This can be reviewed here: Declaration of Helsinki.

    Not that I want to take shortcuts here, but in case you didn't know there are 30+ tenets! It's safe to say that there is a lot of overlap with these ethical principles. For the sake of not being repetitive, we can assume this case violated the Helsinki tenets. I can only imagine if we walked through each principle how long this post would be!

    (Back to Contents)

    Review of Remaining Documentation within the FDA Docket

    I'm curious of how spot on my analysis is now that we are going to review other critical documents.

    Let's deep dive into the other elements of the case.

    The "Good Science" Article

    Here is the article: Bad Science Used to Support Torture and Human Experimentation.

    In short, this relates to FDA-2025-P-5514-0004: Exhibit E-9 โ€” Misuse of Science in Torture Justifications. Upon review:

    • Exhibit E-9 discusses why Bad Science Used to Support Torture and Human Experimentation article is not "good science".
    • The "good science" articles details how the Office of Medical Services (OMS) and affiliated behavioral scientists falsely claimed scientific validation by referencing internal field reports and memoranda as though they were controlled studies.
      • The science used to justify torture was bad because it repeatedly failed to assess important long-term physical and mental health outcomes.
      • To avoid this from happening again, recommendations with respect to the following topics were provided:
        • Independence and accountability
        • Peer review and monitoring
        • Training and education
        • Government accountability
    • Further, per Exhibit E-9:
      • This misuse of empirical language gave policy-makers a pseudo-scientific justification to continue torture while claiming medical supervision.
      • The OMSโ€™s interpretation of physiological data ignored established neurobiological evidence showing that severe stress, hypoxia, and sleep deprivation cause long-term neurocognitive and psychological injury.
      • By reclassifying human suffering as โ€œdata,โ€ medical personnel violated:
        • The Nuremberg Code (1947),
        • The Declaration of Helsinki, and
        • The U.S. Common Rule (45 CFR 46)
      • The authors emphasize that no circumstanceโ€”national security, emergency, or warโ€”permits deviation from these ethical standards.

    (Back to Contents)

    Here, I reviewed the following documents:

    The first document complements FDA-2025-P-5514-0001 within the docket (associated with the original petition). Nature of violations described in greater detail (see image below):

    Initial legal and ethical frameworks were also introduced (see image below):

    For the second document:

    • This describes the complete legal framework for the case (i.e., regulations that are relevant to the docket).
    • Details can be reviewed within the file, to summarize:
      • The alleged experiments and interventions(electroconvulsive shock, electromagnetic fields, human-to-human neural interfacing) clearly fall under โ€œresearch involving devices or procedures not clinically approved.โ€
      • Due to no informed consent, IRB review, device labeling, or IDE authorization, actions described here directly violate 45 CFR 46 and 21 CFR 812.
      • These violations are compounded when the procedures are used as instruments of torture (i.e., they violate both human-rights and regulatory law).

    (Back to Contents)

    The Coup De Gras

    This reviews FDA-2025-P-5514-0007: Torture Journal Entry by Kimberly C. Tanner 10-17-25.

    In essence, this incredibly vivid journal entry describes the torture Kimberly C. Tanner went through during these experiments. I'd like to use these next couple of bullet points solely to highlight direct quotes from the journal entry. In my opinion, these horrific statements speak to the importance of this FDA investigation and the magnitude of the situation.

    • "Fearmongering is a factor, but real fear is at play since I have no idea how many years this will take off my life, how much damage is being done to my brain and the rest of my body including other organs of my body since no part of my body is off limits to Operator #1, who also has no conscience and behaves maliciously most of the time."
    • "Iโ€™d like to also add that non-consensual human-human interfacing is molestation in and of itself."

    (Back to Contents)

    Closing Thoughts

    This song played in my head as soon as I formatted this section:

    "Closing time, you don't have to go home but you can't stay here"

    handwritten message on brown background

    I'm thinking this must have been a FDA-regulated study (given the device regulations that were cited. However, I also wonder if this was DOD-sponsored research. One of the ethical/legal frameworks that was mentioned within the case was specific to DOD. I wonder if it is safe to assume that this isn't a clinical trial (given ICH GCP E6(R3) guidelines weren't mentioned). I know that I'm not a lawyer. However, I did have fun analyzing this case. It's amazing that these ethical principles that were applied to human rights violations in the 1940s still hold true today.

    Just as the image says, human rights are not optional. Participant protections are not optional. This is why myself (and other professionals within our field) hold these ethical tenets so close to heart.

    (Back to Contents)


    I hope you found this post thought-provoking and insightful!

  • NIH FY25 Human Research Policy Notice Summary

    NIH FY25 Human Research Policy Notice Summary

    Eager to skip ahead to today’s content?

    Jump to the Table of Contents.

    Good morning, good afternoon, and good evening, Compliance Rockstars, Clinical Research Professionals, Ethics Enthusiasts, Legal Experts, and Investigators!

    320+ subscribers and counting!

    Authored By: Tasha Mohseni

    We are just about 70% done with the first month of FY26.

    If you follow me on LinkedIn, you’re likely aware that I constantly share regulatory updates. Not only do I do this on my own page, but also through my LinkedIn groups.

    linkedin logo on laptop screen

    I also like to share these updates within other professional forums such as PRIM&R. As I’ve mentioned on LinkedIn and through the blog, it is tough to keep up with everything. I especially felt that way given all the CY25 events that have happened and are still going! Why shouldn’t we think of ways to make things easier for folks in the research regulatory field. This is especially critical now given the evolving regulatory landscape.

    I’d like to continue to provide research regulatory updates via CREST and my personal LinkedIn. For today’s article, I’d like to cover the NIH FY25 Human Research Policy Notices:

    • I’ll start with a summary matrix for each policy which will include:
      • A brief explanation of the purpose
      • Key dates
      • Related policy notices
      • Related resources to better understand each policy
    • Then, we will deep dive into each notice.
      • Essentially, I will directly quote/detail out any key information that was not provided in the matrix.

    This is inspired by my LinkedIn post related to the NIH FY25 Policy Pulse. If you didn’t see the post, don’t worry! I’m going to cover this as well.

    As a general reminder, these are my own interpretations. Any legal information discussed within this post should be discussed with your institution.

    Advertisements

    Table of Contents:

    1. NIH FY25 Policy Pulse
      1. Human Research FY25 Policy Notice Dashboard
    2. NOT-OD-25-081: Protecting Human Genomic Data when Developing Generative Artificial Intelligence Tools and Applications
    3. NOT-OD-25-083: Implementation Update: Enhancing Security Measures for NIH Controlled-Access Data
    4. NOT-OD-25-131: Revision: NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research
    5. NOT-OD-25-134: Flexibilities for Registration and Results Reporting of Prospective Basic Experimental Studies with Human Participants
    6. NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations
    7. NOT-OD-25-159: Required Security and Operational Standards for NIH Controlled-Access Data Repositories
    8. NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

    NIH FY25 Policy Pulse

    The NIH FY25 Policy Pulse includes policy notice updates issued by the NIH in FY25 related to:

    • Grants management,
    • Human research,
    • Animal research, and
    • Biological research.

    This also includes a list of rescinded policy notes. This doesn’t include funding announcements or any other changes from other HHS agencies.

    • If there is a policy update I missed, please leave a comment below or email me at crest.innovation25@gmail.com! I would love to credit you on revisions to this summary tool.

    Human Research FY25 Policy Notice Dashboard

    Before we dive in each of these policy updates, I wanted to provide a summary dashboard below:

    • Please note that there are also two policy updates related to biological research within the dashboard. These two updates also relate to human research:
      • NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations
      • NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

    (Back to the Top)

    NOT-OD-25-081: Protecting Human Genomic Data when Developing Generative Artificial Intelligence Tools and Applications

    The policy further describes:

    • The Genomic Data Sharing (GDS) Policy and the subsequent Data Use Certification (DUC) Agreement:
      • Prohibit users from distributing controlled-access data (including genomic or associated data) or their Data Derivatives to any entity or individual not identified in their Data Access Request without appropriate written approvals from the NIH
      • States that sharing, retaining, or training generative AI models using controlled-access human genomic data may risk disclosing controlled-access data and, thus, violates the Non-Transferability provision of the DUC
      • Further, it states that sharing controlled-access data with public generative AI tools (e.g., third party tools) via prompts or other user interfaces is in violation of the provision on Non-Transferability, and by extension, the DUC
    • NIH intends to provide future guidance on the responsible use and sharing of generative AI models and controlled-access data
      • Until that guidance is issued, as described in the DUC, Approved Users of controlled-access data may continue to develop generative AI models using the controlled-access data so long as the use is approved by NIH, but:
        • (1) may not share the model, including model parameters, except with collaborators who are also Approved Users and
        • (2) may not retain the generative AI model, including model parameters, upon closeout of the project as instructed in provision 13.

    (Back to the Top)

    Advertisements

    NOT-OD-25-083: Implementation Update: Enhancing Security Measures for NIH Controlled-Access Data

    The policy doesn’t offer additional details to discuss.

    (Back to the Top)

    NOT-OD-25-131: Revision: NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research

    Though there are no specific resources, the policy further describes:

    • A brief background of NIH charged with establishing guidelines for inclusion of women and racial and/or ethnic minorities in clinical research
    • NIH sets the expectation that women and members of racial and/or ethnic minority groups and their subgroups must be included in all NIH-funded clinical research, unless a clear and compelling rationale and justification that inclusion is inappropriate with respect to the health of the participants or the purpose of the research
    • Cost is not an acceptable reason for exclusion except when the study would duplicate data from other sources
    • Pregnant women should not be routinely excluded from participation in clinical research
    • When an NIH-defined Phase 3 clinical trial is proposed, evidence must be reviewed to show whether or not clinically important sex, race, and/or ethnicity differences in the intervention effect are to be expected
      • For NIH-defined Phase 3 applicable clinical trials, submissions of results to ClinicalTrials.gov must include results of valid analyses by sex and race and/or ethnicity, as required based on prior evidence
    • Roles and responsibilities are listed to ensure successful implementation of this policy
    • The policy concludes with a list of definitions and associated regulations

    (Back to the Top)

    NOT-OD-25-134: Flexibilities for Registration and Results Reporting of Prospective Basic Experimental Studies with Human Participants

    In further detail, the policy explains:

    • BESH studies meet both the NIH definition of a clinical trial and also the definition of basic research.
    • NIH is indefinitely extending the period of delayed enforcement for registration and results reporting including those with application due dates on or after September 25, 2025.
    • Plans for meeting the NIH registration and results reporting expectations using an alternative platform should be described at the time of application in the Dissemination Plan attachment.
    • NIH continues to expect Good Clinical Practice (GCP) training for all personnel involved in the conduct, oversight, or management of all BESH.

    As there wasn’t space within the matrix, resources mentioned within the policy are listed below:

    (Back to the Top)

    Advertisements

    NOT-OD-25-153: NIH Disposition of Biospecimens Collected from Tribal Populations

    In addition to providing general definitions, the policy further describes the five options in detail.:

    • Direct return of biospecimens to Tribe(s)
      • The de-identified biospecimens can be returned directly to Tribe(s) if Tribe(s) is able to receive biospecimens per applicable national, state, and local laws and regulations and per Tribal customary practices and regulations
    • Indirect return of biospecimens to a third-party institution or organization identified by Tribe(s)
      • When de-identified biospecimens are NIH held and a NIH decision for disposition has been made, de-identified biospecimens can be returned to a Tribally designated third-party institution or organization if the third-party institution/organization is able to receive biospecimens per applicable national, state, and local laws and regulations and per Tribal customary practices and regulations
    • Indirect return of biospecimens to third-party institution or organization identified by NIH in consultation with Tribe(s) and organized by NIH
      • When de-identified biospecimens are NIH held and a NIH decision for disposition has been made, de-identified biospecimens can be returned to a third-party institution or organization identified by NIH in consultation with Tribe(s) that is able to receive biospecimens per applicable national, state, and local laws and regulations
    • After consultation with Tribe(s), Tribe(s) designates NIH as steward for biospecimens
      • IH and Tribe(s) can develop mutually agreed upon terms for continued stewardship and de-identified biospecimen access, in accordance with applicable federal laws, regulations, and policies, and in alignment with Tribal preferences
    • After consultation with Tribe(s), Tribe(s) requests NIH dispose of biospecimens in culturally sensitive manner
      • Tribe(s) can instead request that NIH dispose of de-identified biospecimens
      • Disposal must be in accordance with applicable federal law, regulations, and policy, and occur in a culturally sensitive manner as identified through Tribal Consultation

    (Back to the Top)

    NOT-OD-25-159: Required Security and Operational Standards for NIH Controlled-Access Data Repositories

    The policy further describes background, scope, applicability, and states:

    • NIH Controlled-Access Data Repository (CADRs) should follow the “National Institutes of Health (NIH) Controlled-Access Data Repository Guidebook to Adhere to โ€œRequired Security and Operational Standards for NIH Controlled-Access Data Repositoriesโ€ guidebook
    • NIH CADRs that cannot satisfy these requirements may choose to migrate controlled-access data to another NIH CADR that is compliant with these requirements
    • NIH CADRs must comply with the following categories of requirements as described in the NIH CADR Guidebook by specific effective dates:
      • Effective immediately:
        • NIH CADR Registration and Immediate Steps
      • Effective November 1, 2025:
        • Documentation of Adherence to Relevant Laws and Policies
        • Standard Data Access Processes
      • Effective February 25, 2026:
        • Standard Data Submission Processes
        • Security Standards and Practices
        • Transparency and Utility Standards

    (Back to the Top)

    NOT-OD-25-160: NIH Policy on Enhancing Security Measures for Human Biospecimens

    The policy further describes:

    • The entity (e.g., biorepository, institution, investigator) that holds human biospecimens of U.S. persons collected, obtained, stored, used, or distributed using on-going or new NIH funds are prohibited from directly or indirectly distributing the human biospecimens to institutions or parties located in countries of concern
    • The human biospecimens may be shared or distributed to countries of concern only if use of the human biospecimens is:
      • To meet transactions required or authorized by Federal law or international agreements, including Global health, or necessary for compliance with Federal law; or
      • Needed in rare and compelling circumstances where the facility and personnel in the country of concern possess needed capabilities and/or expertise not available elsewhere, the use of the biospecimen cannot be delayed to a time when capability and/or expertise is available elsewhere, and done with the consent of the individual from whom the biospecimen was collected; or
      • At the request of the individual whose biospecimen was collected, obtained, or stored using NIH-funds; for purposes of diagnosis, prevention or treatment of that individual; and in compliance with applicable Federal laws, regulations, and policies

    As there wasn’t space within the matrix, resources mentioned within the policy are listed below:

    (Back to the Top)


    I hope you found this article useful!

    (Back to the Top)