Conducting a risk analysis is a basic tenet of security compliance, with the overarching goal of understanding where protected health information (PHI) “lives” in an organization, where it moves, where it resides—and then implementing safeguards. Would China be an acceptable final resting place? And would covered entities (CEs) or business associates (BAs), with their often murky subcontractors, even know if the Chinese government was tapping into it?
This isn’t as far-fetched as it may sound. Recent reporting by Reuters has uncovered alleged ties between what it calls a Chinese gene company and the Chinese military. “A prenatal test taken by millions of pregnant women globally was developed by Chinese gene company BGI Group in collaboration with the Chinese military and is being used by the firm to collect genetic data,” Reuters reported in July.[1]
“What Reuters discovered was that, although you sign a consent form as a patient, the identified genetic data from mothers all around the world was getting sent back to Hong Kong and China,” according to Edward You, a supervisory special agent in the FBI’s Weapons of Mass Destruction Directorate. “And yes, they get their results back, but what it means is that as the data resides in China, the Chinese national government [has] laws in place where they can access that data, based on a determination if there’s a national security need.”
You, who recently completed a two-year detail as the FBI’s liaison officer to HHS, spoke on a podcast with John Riggi, senior advisor for cybersecurity and risk for the American Hospital Association (AHA).[2]
You devoted six years of graduate research to retrovirology and human gene therapy at the University of Southern California, Keck School of Medicine, according to Texas A&M, where he is a senior fellow for the Scowcroft Institute of International Affairs at the Bush School of Government and Public Service. His “overall goal is to safeguard the scientific community, the life science research enterprise, and the U.S. bioeconomy.”[3]
