It's interesting because losing someone's PII that includes information that can lead to financial fraud can bankrupt a company. Losing someone's DNA data (or

It's interesting because losing someone's PII that includes information that can lead to financial fraud can bankrupt a company. Losing someone's DNA data (or sharing it without permission a la 23andme) doesn't have the potential for financial losses. It will be interesting to see how this company is penalized (HiPPA fines are pretty tame comparatively.) As an aside, in the relatively recent past I worked on a system that contained data covered under HiPPA. We isolated the systems (and networks) so that the health data itself had no identifying information - just a unique key. When the user was authenticated, their PII and the medical information was merged on their browser screen. These two systems were properly secured but I don't ever believe a system is invulnerable (unless it has no network connection). Still, you'd have to breach both systems to combine the data en masse.