NIH Policy on Enhancing Security Measures for Human Biospecimens

The NIH Policy on Enhancing Security Measures for Human Biospecimens (NIH Biospecimens Security Policy) establishes expectations for security safeguards to protect human biospecimens collected, obtained, stored, used, or distributed with NIH support. The policy is intended to protect research participants and national security interests by mitigating risks related to unauthorized access, misuse, or distribution of biospecimens, particularly to designated countries of concern.

NIH implemented this policy to:

• Protect research participants and their contributions
• Address evolving security risks to biological materials
• Promote consistency in biospecimen security practices across institutions
• Ensure responsible stewardship of biospecimens, regardless of whether they are identifiable

NIH issued this policy in alignment with:

• Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern,” and
• The U.S. Department of Justice’s Bulk Data Rule codified at 28 C.F.R. Part 202.

Both directives emphasize strengthening protections for sensitive data and biological materials, including biospecimens, from misuse by designated adversarial entities.

The policy applies to:

• All human biospecimens obtained from U.S. persons that are:
  • Collected, obtained, stored, used, or distributed human biospecimens AND
  • Supported or funded by any on-going or new NIH funding mechanisms (grants, cooperative agreements, contracts, other transactions, and intramural support) regardless of NIH funding level.
• The policy applies regardless of whether biospecimens are identifiable, coded, or de-identified.
• This Policy does not apply to cell derivative products or cell lines derived from human biospecimens of U.S. persons collected, obtained, stored, used, or distributed using on-going or new NIH funds that are commercially or publicly available prior to September 24, 2025.

The policy defines human biospecimens broadly to include any quantity of tissue, blood, urine, or other human-derived material, whether primary or derived, including cell lines generated from NIH-supported biospecimens.

Human biospecimens include, but are not limited to:

• Blood, serum, plasma
• Tissue (solid or liquid)
• Cells, DNA, RNA, and other derivatives
• Saliva, urine, and other bodily fluids

Primary Prohibition

Entities holding NIH-supported human biospecimens from U.S. persons are generally prohibited from directly or indirectly distributing those biospecimens to institutions or parties located in countries of concern.

Limited Exceptions

NIH allows distribution in limited, documented circumstances such as:

1. When required or authorized by federal law, regulation, or international agreement.
2. Where unique expertise exists in a country of concern and delay is not feasible.
3. When the individual donor specifically requests and consents for use in that country for medical purposes; provided that documentation is maintained and shared with NIH upon request.

All potential exceptions should be discussed with the Export Compliance Office.

Additionally, NIH expects the research community to recognize the risks posed by the sharing or distribution of U.S. persons biospecimens that were collected, obtained, stored, used, or distributed with previous NIH funds or support with countries of concern.

Documentation and Recordkeeping

Institutions must retain documentation supporting any distribution to a country of concern under an allowable scenario, including biospecimen content and quantity, and provide such documentation to NIH upon request.

“Countries of concern” are those identified under 28 C.F.R. § 202.601 (Subpart F), as referenced by the NIH policy. This typically includes nations such as the People’s Republic of China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. This list should be referenced routinely, as the designations may evolve.

Yes. The export of human biospecimens must follow all applicable export administration regulations. Researchers can contact the Export Compliance Office for additional information. If you have questions related to biosafety and shipping biological material, please contact shippingdg@ehrs.upenn.edu.

Yes. Agreements for biospecimen transfer (MTAs/DUAs) should align with NIH expectations and must include:

• Clauses prohibiting onward transfer to countries of concern;
• Requirements for recipients to verify compliance/downstream distribution restrictions; and
• Documentation of applicable exceptions, where relevant.

Institutions must establish procedures to:

• Promptly contact the Office of Research Services, the Office of Export Compliance, or the Research Compliance Officer to report suspected or confirmed incidents involving unauthorized biospecimen transfer;
• Mitigate risk and prevent recurrence; and
• Notify NIH or other authorities as required.

Researchers and institutional officials should:

• Complete Research Security Training.
• Familiarize themselves with institutional biospecimen shipping policies.
• Review and update internal biospecimen handling policies to reflect NIH requirements.
• Update MTAs with appropriate clauses referencing NOT-OD-25-160.
• Consult the Export Compliance Office for international transfers.
• Train laboratory and research personnel on policy expectations.
• Maintain and preserve documentation for biospecimen transfers, especially for exceptions.
• Consult with ORS, Export Compliance Office, or the Research Compliance Officer with questions.
• Engage with NIH program officials for questions.

Non-compliance could affect current or future NIH funding.

Researchers can contact:

• Office of Research Services
• Office of Export Compliance
• Research Compliance Officer, Kcraig@upenn.edu

Resources

Policy Reference: NIH Policy on Enhancing Security Measures for Human Biospecimens, Notice Number NOT-OD-25-160 (Release Date: September 24, 2025; Effective Date: October 24, 2025).

Federal Register Publication: NIH Policy on Enhancing Security Measures for Human Biospecimens, Federal Register Vol. 90, No. 237 (December 12, 2025).