Protecting Americans’ Genomic Information Act of 2021

To direct the Secretary of Health and Human Services to ensure that certain biomedical research is conducted in a manner that considers national security risks, and for other purposes. 1. Short title This Act may be cited as the Protecting Americans’ Genomic Information Act of 2021 2. Securing identifiable, sensitive information (a) Consideration of national security risks (1) In general The Secretary of Health and Human Services (referred to in this section as the Secretary (2) Biomedical research described For purposes of paragraph (1), biomedical research is described in this paragraph if it— (A) is conducted or supported, directly or indirectly, including through subgrants, by the National Institutes of Health or other relevant agencies and offices within the Department of Health and Human Services; and (B) involves the sequencing of human genomic information, and collection, analysis, or storage of identifiable, sensitive information, as defined in section 301(d)(4) of the Public Health Service Act ( 42 U.S.C. 241(d)(4) (b) Risk framework Not later than 2 years after the date of enactment of this Act, the Secretary shall ensure that the National Institutes of Health and other relevant agencies and offices within the Department of Health and Human Services, working with the heads of agencies and national security experts, including the Office of the National Security within the Department of Health and Human Services— (1) develop a comprehensive framework for assessing and managing national security risks referred to in subsection (a) that includes— (A) criteria for how and when to conduct risk assessments for projects that may have national security implications; (B) security controls and training for researchers or entities, including peer reviewers, that manage or have access to such data; and (C) methods to incorporate risk-reduction in the process for funding such projects that may have national security implications; (2) not later than 1 year after the risk framework is developed under paragraph (1), develop and implement controls to— (A) ensure that researchers or entities that manage or have access to such data have complied with the requirements of paragraph (1) and ongoing requirements with such paragraph; and (B) ensure that data access committees reviewing data access requests for projects that may have national security risks, as appropriate, include members with expertise in current and emerging national security threats, in order to make appropriate decisions related to access to such identifiable, sensitive information; and (3) not later than 2 years after the risk framework is developed under paragraph (1), update data access and sharing policies related to human genomic data, as appropriate, based on current and emerging national security threats. (c) Congressional briefing Not later than 2 years after the date of enactment of this Act, the Secretary shall provide a briefing to the Committee on Health, Education, Labor, and Pensions and the Select Committee on Intelligence of the Senate and the Committee on Energy and Commerce and the Permanent Select Committee on Intelligence of the House of Representatives on the activities required under subsections (a) and (b).

Summary: Protecting Americans' Genomic Information Act of 2021 This bill requires the Department of Health and Human Services (HHS) to address national security concerns when conducting or supporting biomedical research that involves human genomic sequencing and sensitive, identifiable information. Specifically, HHS must implement a risk framework to assess whether such research conducted by the National Institutes of Health or other HHS agencies and offices poses risks to national security and identify approaches to mitigate those risks, including through security controls and training for those that manage or have access to such research. After the framework is developed, HHS must implement data access controls, ensure that data access committees include members with national security expertise, and update relevant data access and sharing policies. The bill also requires HHS to brief Congress about these activities.