H. R. 2617—1308 
of human genomic information, and collection, analysis, or storage 
of identifiable, sensitive information, as defined in section 301(d)(4) 
of the Public Health Service Act (42 U.S.C. 241(d)(4)), and the 
potential misuse of such data. Not later than 2 years after the 
date of enactment of this Act, the Secretary shall ensure that 
the National Institutes of Health and other relevant agencies and 
offices within the Department of Health and Human Services, in 
consultation with the heads of agencies and national security 
experts, including the Office of the National Security within the 
Department of Health and Human Services— 
(1) develop a comprehensive framework and policies for 
assessing and managing such national security risks that 
includes, or review and update, as appropriate, the current 
(as of the date of review) such framework and policies to 
include— 
(A) criteria for how and when to conduct risk assess-
ments for projects that may have national security implica-
tions; 
(B) security controls and training for researchers or 
entities, including peer reviewers, that manage or have 
access to such data that may present national security 
risks; and 
(C) methods to incorporate risk mitigation in the 
process for funding such projects that may have national 
security implications and monitor associated research 
activities following issuance of an award, including changes 
in the terms and conditions related to the use of such 
funds, as appropriate; 
(2) not later than 1 year after the framework and policies 
are developed or reviewed and updated, as applicable, under 
paragraph (1), develop and implement controls to ensure that— 
(A) researchers or entities involved in projects reviewed 
under the framework and relevant policies, including such 
projects that manage or have access to sensitive, identifi-
able information, have complied with the requirements of 
paragraph (1) and ongoing requirements with such para-
graph; 
(B) consideration of funding for projects that may have 
national security implications takes into account the extent 
to which the country in which the proposed research will 
be conducted or supported poses a risk to the integrity 
of the United States biomedical research enterprise; and 
(C) data access committees reviewing data access 
requests for projects that may have national security risks, 
as appropriate, include members with expertise in current 
and emerging national security threats, in order to make 
appropriate decisions, including related to access to such 
identifiable, sensitive information; and 
(3) not later than 2 years after the framework and relevant 
policies are developed or reviewed and updated, as applicable, 
under paragraph (1), update data access and sharing policies 
related to human genomic data, as applicable, based on current 
and emerging national security threats. 
(b) CONGRESSIONAL BRIEFING.—Not later than 1 year after 
the date of enactment of this Act, the Secretary shall provide 
a briefing to the Committee on Health, Education, Labor, and 
Pensions and the Select Committee on Intelligence of the Senate
H. R. 2617—1309 
and the Committee on Energy and Commerce and the Permanent 
Select Committee on Intelligence of the House of Representatives 
on the activities required under subsection (a). 
SEC. 2323. DUTIES OF THE DIRECTOR. 
Section 402(b) in the Public Health Service Act (42 U.S.C. 
282(b)), as amended by section 2302, is further amended by 
inserting after paragraph (26) (as added by section 2302) the fol-
lowing: 
‘‘(27) shall consult with the Director of the Office of 
National Security within the Department of Health and Human 
Services, the Assistant Secretary for Preparedness and 
Response, the Director of National Intelligence, the Director 
of the Federal Bureau of Investigation, and the heads of other 
appropriate agencies on a regular basis, regarding biomedical 
research conducted or supported by the National Institutes 
of Health that may affect or be affected by matters of national 
security; 
‘‘(28) shall ensure that recipients of awards from the 
National Institutes of Health, and, as appropriate and prac-
ticable, entities collaborating with such recipients, have in place 
and are adhering to appropriate technology practices and poli-
cies for the security of identifiable, sensitive information, 
including information collected, stored, managed, or analyzed 
by domestic and non-domestic entities; and 
‘‘(29) shall ensure that recipients of awards from the 
National Institutes of Health are in compliance with the terms 
and conditions of such award, which may include activities 
to support awareness of, and compliance with, such terms and 
conditions by any subrecipients of the award.’’. 
SEC. 2324. PROTECTING AMERICA’S BIOMEDICAL RESEARCH ENTER-
PRISE. 
(a) IN GENERAL.—The Secretary, in consultation with the 
Assistant to the President for National Security Affairs, the Director 
of National Intelligence, the Director of the Federal Bureau of 
Investigation, and the heads of other relevant departments and 
agencies, and in consultation with research institutions and 
research advocacy organizations or other relevant experts, as appro-
priate, shall— 
(1) identify ways to improve the protection of intellectual 
property and other proprietary information, as well as identifi-
able, sensitive information of participants in biomedical 
research and development, from national security risks and 
other applicable threats, including the identification of gaps 
in policies and procedures in such areas related to biomedical 
research and development supported by the Department of 
Health and Human Services, and make recommendations to 
institutions of higher education or other entities that have 
traditionally received Federal funding for biomedical research 
to protect such information; 
(2) identify or develop strategies to prevent, mitigate, and 
address national security risks and threats in biomedical 
research and development supported by the Federal Govern-
ment, including such threats associated with foreign talent 
programs, by countries seeking to exploit United States tech-
nology and other proprietary information as it relates to such
H. R. 2617—1310 
biomedical research and development, and make recommenda-
tions for additional policies and procedures to protect such 
information; 
(3) identify national security risks and potential misuse 
of proprietary information, and identifiable, sensitive informa-
tion of biomedical research participants and other applicable 
risks, including with respect to peer review, and make rec-
ommendations for additional policies and procedures to protect 
such information; 
(4) develop a framework to identify areas of biomedical 
research and development supported by the Federal Govern-
ment that are emerging areas of interest for state actors and 
would compromise national security if they were to be subjected 
to undue foreign influence; and 
(5) regularly review recommendations or policies developed 
under this section and make additional recommendations or 
updates, as appropriate. 
(b) REPORT TO PRESIDENT AND TO CONGRESS.—Not later than 
1 year after the date of enactment of this Act, the Secretary shall 
prepare and submit, in a manner that does not compromise national 
security, to the President and the Committee on Health, Education, 
Labor, and Pensions and the Select Committee on Intelligence 
of the Senate, the Committee on Energy and Commerce and the 
Permanent Select Committee on Intelligence of the House of Rep-
resentatives, and other congressional committees as appropriate, 
a report on the findings and recommendations pursuant to sub-
section (a). 
SEC. 2325. GAO STUDY. 
(a) IN GENERAL.—The Comptroller General of the United States 
(referred to in this section as the ‘‘Comptroller General’’) shall 
conduct a study to assess the extent to which the Department 
of Health and Human Services (referred to in this section as the 
‘‘Department’’) utilizes or provides funding to entities that utilize 
such funds for human genomic sequencing services or genetic serv-
ices (as such term is defined in section 201(6) of the Genetic 
Information Nondiscrimination Act of 2008 (42 U.S.C. 2000ff(6))) 
provided by entities, or subsidiaries of such entities, organized 
under the laws of a country or countries of concern, in the estimation 
of the Director of National Intelligence or the head of another 
Federal department or agency, as appropriate. 
(b) CONSIDERATIONS.—In carrying out the study under this 
section, the Comptroller General shall— 
(1) consider— 
(A) the extent to which the country or countries of 
concern could obtain human genomic information of citizens 
and residents of the United States from such entities that 
sequence, analyze, collect, or store human genomic informa-
tion and which the Director of National Intelligence or 
the head of another Federal department or agency reason-
ably anticipates may use such information in a manner 
inconsistent with the national security interests of the 
United States; 
(B) whether the Department or recipient of such funds 
from the Department sought to provide funding to, or to 
use, domestic entities with no such ties to the country
H. R. 2617—1311 
or countries of concern for such purposes and any barriers 
to the use of domestic entities; and 
(C) whether data use agreements, data security meas-
ures, and other such measures taken by the Department 
or recipient of such funds from the Department are suffi-
cient to protect the identifiable, sensitive information of 
the people of the United States and the national security 
interests of the United States; and 
(2) make recommendations to address any vulnerabilities 
to the United States national security identified, as appropriate. 
(c) ESTIMATION.—In conducting the study under this section, 
the Comptroller General may, as appropriate and necessary to 
complete such study, investigate specific instances of such utiliza-
tion of genetic sequencing services or genetic services, as described 
in subsection (a), to produce estimates of the potential prevalence 
of such utilization among entities in receipt of Departmental funds. 
(d) REPORT.—Not later than 2 years after the date of enactment 
of this Act, the Comptroller General shall submit a report on 
the study under this section, in a manner that does not compromise 
national security, to the Committee on Health, Education, Labor, 
and Pensions and the Select Committee on Intelligence of the 
Senate, and the Committee on Energy and Commerce and the 
Permanent Select Committee on Intelligence of the House of Rep-
resentatives. The report shall be submitted in unclassified form, 
to the extent practicable, but may include a classified annex. 
SEC. 2326. REPORT ON PROGRESS TO ADDRESS UNDUE FOREIGN 
INFLUENCE. 
Not later than 1 year after the date of enactment of this 
Act and annually thereafter, the Secretary shall prepare and submit 
to the Committee on Health, Education, Labor, and Pensions of 
the Senate and the Committee on Energy and Commerce in the 
House of Representatives, in a manner that does not compromise 
national security, a report on actions taken by the Secretary— 
(1) to address cases of noncompliance with disclosure 
requirements or research misconduct related to foreign influ-
ence, including— 
(A) the number of potential noncompliance cases inves-
tigated by the National Institutes of Health or reported 
to the National Institutes of Health by a research institu-
tion, including relating to undisclosed research support, 
undisclosed conflicts of interest or other conflicts of commit-
ment, and peer review violations; 
(B) the number of cases referred to the Office of 
Inspector General of the Department of Health and Human 
Services, the Office of National Security of the Department 
of Health and Human Services, the Federal Bureau of 
Investigation, or other law enforcement agencies; 
(C) a description of enforcement actions taken for non-
compliance related to undue foreign influence; and 
(D) any other relevant information; and 
(2) to prevent, address, and mitigate instances of non-
compliance with disclosure requirements or research mis-
conduct related to foreign influence.