October 2026 | A.S.H.A. Law Office PLLC
Healthcare companies routinely rely on third-party providers for software development, cloud infrastructure, billing, customer support, and data management. Some of these providers operate overseas or employ personnel outside the United States. While these arrangements can reduce costs and improve efficiency, they may also create compliance obligations under the Department of Justice’s Data Security Program (DSP), which took effect on April 8, 2025.
The DSP restricts certain transactions that provide countries of concern or covered persons access to Americans’ bulk sensitive personal data or U.S. government-related data. For healthcare companies, the concern extends beyond intentional data transfers. Existing vendor relationships, including arrangements for remote technical support or database administration, may fall within the rule.
HIPAA Compliance Does Not Resolve DSP Obligations
Healthcare companies are generally familiar with the Health Insurance Portability and Accountability Act (HIPAA), which establishes requirements for protecting certain health information. The DSP addresses a different concern: national security risks associated with access to sensitive U.S. data by designated foreign countries and persons.
A company may have appropriate HIPAA safeguards and business associate agreements in place but still need to evaluate whether its vendor relationships comply with the DSP.
The distinction matters because the DSP focuses on the nature of the data, the parties involved, and the access permitted through particular transactions. Compliance with existing healthcare privacy requirements does not, by itself, establish compliance with the DSP.
When Does a Healthcare Vendor Relationship Become a DSP Concern?
Consider a U.S. digital health company that maintains medical records for 50,000 American patients. The company contracts with an overseas technology provider to maintain its software platform. Under the agreement, the provider’s technical personnel have administrative access to the database containing patient information.
Whether this arrangement is subject to the DSP depends on several factors.
First, the company must determine whether the information qualifies as sensitive personal data under the rule. The DSP establishes a bulk threshold of 10,000 U.S. persons for personal health data. Other categories have lower thresholds, including biometric identifiers at 1,000 U.S. persons and human genomic data at 100 U.S. persons.
Second, the company must assess whether the vendor, its ownership, or personnel with relevant access have a connection to a country of concern or otherwise qualify as covered persons. The DSP currently identifies China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela as countries of concern.
Third, the company must evaluate the transaction itself, including the scope of access permitted under the agreement and whether any regulatory exemption applies.
If the arrangement constitutes a restricted vendor transaction, the company generally must satisfy applicable security and compliance requirements before proceeding. These include security requirements established by the Cybersecurity and Infrastructure Security Agency (CISA).
Not every overseas vendor relationship is covered. A vendor’s location outside the United States does not automatically make it a covered person, and the DSP does not impose a general prohibition on international data processing.
Existing Contracts Deserve Attention
Companies assessing DSP exposure should examine existing vendor agreements, not just new contracts.
A technology provider may have access to sensitive data even when its primary responsibility is software maintenance rather than data processing. Administrative privileges, troubleshooting permissions, remote access arrangements, and subcontractor relationships can all affect the analysis.
Contract provisions alone may not provide a complete picture. A company may restrict access in its agreement while permitting broader access through its operational systems.
For that reason, an effective assessment requires coordination between legal, compliance, procurement, and technical personnel. The objective is to understand what access is authorized, what access is technically possible, and whether the arrangement creates a covered transaction.
Building a Practical Compliance Response
Healthcare companies do not necessarily need to establish an entirely separate compliance program to address the DSP. Existing vendor management, privacy, and cybersecurity processes may provide a useful foundation.
An initial assessment should establish which datasets meet the applicable thresholds and identify the agreements through which foreign parties may obtain access. Companies can then evaluate relevant ownership and geographic connections, classify potentially covered transactions, and determine whether restrictions or exemptions apply.
Where a restricted transaction is identified, the company must evaluate the applicable CISA security requirements and additional DSP obligations, including due diligence, recordkeeping, and, where required, independent auditing.
Depending on the circumstances, appropriate measures may include limiting vendor permissions, modifying contractual terms, restructuring access arrangements, or implementing the prescribed technical safeguards. Some transactions, particularly those involving bulk human genomic data, may be prohibited rather than eligible to proceed under the restricted-transaction framework.
The appropriate response depends on the data and transaction involved. A company should not assume that a standard data processing agreement or existing cybersecurity certification satisfies the rule.
Where Healthcare Companies Should Start
The most useful starting point is an inventory of sensitive data and the business relationships that permit access to it.
For digital health companies, this may reveal that DSP exposure is concentrated in a small number of vendor arrangements rather than across the entire organization. It may also establish that certain relationships fall outside the rule.
Either conclusion is valuable when supported by a documented assessment.
The DSP adds a national security dimension to healthcare data governance. Companies that already maintain privacy and cybersecurity programs are well positioned to incorporate these requirements, provided they evaluate foreign access and covered transactions rather than relying exclusively on existing privacy controls.
About A.S.H.A. Law Office PLLC
A.S.H.A. Law advises businesses on the DOJ Data Security Program, cross-border data transactions, privacy and cybersecurity compliance, and vendor risk. The firm helps companies assess regulatory exposure and develop practical compliance programs suited to their operations.
To evaluate whether your company’s data or vendor relationships may be subject to the DSP, visit ashalaw.com to begin a DSP self-assessment.
This article is provided for general informational purposes and does not constitute legal advice. Application of the DSP depends on the facts and circumstances of each transaction.