HIPAA does not explicitly call out genetic/genomic information as one of the oft-cited 18 elements of protected information [1]. However, genetic/genomic inform

HIPAA does not explicitly call out genetic/genomic information as one of the oft-cited 18 elements of protected information [1]. However, genetic/genomic information is considered to fall under the 18th element, and HHS states that it must be treated as PHI [2,3]. In fact, HIPAA is very broad in its definition of PHI: "The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4] Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6] [1]: https://cphs.berkeley.edu/hipaa/hipaa18.html [2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html [3]: https://www.law.cornell.edu/cfr/text/45/160.103 [4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html [5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999 [6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act