I don't really think you're trying to engage in a good faith discussion, but in case you are: Lots of companies that handle medical information are exempt from

I don't really think you're trying to engage in a good faith discussion, but in case you are: Lots of companies that handle medical information are exempt from HIPAA. "Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule."[1] Generally many of our practices meet or exceed HIPAA requirements, either because we're complying with some other rule (like GDPR, or Common Rule for protection of subjects in research), or because we think we should. You also still haven't given a specific example of something you think we're doing that you don't like. For example acquiring, analyzing and storing medical data is sort of required in order to provide our service to our customers so unless you think DTC genomics is fundamentally without merit this doesn't seem objectionable. If your concern is the "trades in" I think you may not understand exactly how we operate. Our privacy statement says we won't share even de-identified individual-level data without obtaining consent to do so. We rarely do that, for nearly all of our work, we only share statistical results from pooling information from thousands of individuals, where there is no way to extract data about any individual that contributed to the analysis. As for the original article, I'll stake my professional experience that it's simply not technically possible to do a GEDmatch lookup using "reformatted" CODIS data from 2002. The article says that DNA was submitted to Parabon, not a CODIS profile, Parabon uses SNP arrays, GEDmatch uses SNP arrays, and if you think somehow they didn't in this instance you're frankly delusional. There certainly are issues with testing old DNA samples and I'm not arguing about any of the difficulties with establishing chain of custody for old evidence, the complexity of statistics for CODIS matching, asserting guilt without a trial, etc. I haven't made any statements about any of that. [1] https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp