What about those DNA companies that collect even more sensitive medical information - your DNA - and then straight up sell it to companies who'll use it against

What about those DNA companies that collect even more sensitive medical information - your DNA - and then straight up sell it to companies who'll use it against you (health insurance)? Why are these guys not facing billions in fines and being dissolved for egregious violations? Edit: It seems that none of these are HIPAA violations because these companies aren't classified as medical organisations.