I was a medical researcher and also a data engineer for a biotech and I've never seen a dataset that required background checks, or "fingerprint locked rooms" (fingerprints are not biometric security). Instead, a partner company (a well-known, multibillion dollar biotech) handed us a pile of hard drives that were encrypted by trivial keys.

I sat down with the CEO and discussed our plans (to upload the data to our S3 buckets with ACLs) along with all our other security plans, pointed out the two of us were professionally and legally on the hook (her more than me, as I was not an executive and had limited liability), and what I was doing to protect the clinical data we had. We looked at our plans, and ultimatley concluded we could both sleep happily at night with what we were doing.

It was definitely a lot of work to maintain the ACLs and monitoring and checking to make sure we weren't leaking data, and a lot of education for our scientists. Even if something negative had happened, we would have been able to foresically detect it, and work with legal authorities with confidence we had done a good-faith, better-than-average practices implementation.