The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reade

The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3] Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach. [0]: https://news.ycombinator.com/item?id=21465420 https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843028-What-health-related-information-can-I-learn-from-23andMe- https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466094 https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/ https://smiledirectclub.com/privacy/