HIPAA doesn't apply to everyone. There's a definition for "covered entities". For example, if you tell me about your medical condition, I can tell anyone I like

HIPAA doesn't apply to everyone. There's a definition for "covered entities". For example, if you tell me about your medical condition, I can tell anyone I like. I can't find any reference to HIPAA in 23andme's privacy policy and I don't believe they are currently considered a covered entity. I don't even know if their data is considered medical information in the same way a diagnosis would be.