23andMe doesn't fall under HIPAA at all. HIPAA is scoped to only cover specific entities. Once someone sells/gives your PHI to a non-HIPAA entity, then it's no

23andMe doesn't fall under HIPAA at all. HIPAA is scoped to only cover specific entities. Once someone sells/gives your PHI to a non-HIPAA entity, then it's no longer private at all. There are usually disclaimers and warnings about this from providers when you release such things. This is because HIPAA isn't designed to protect your privacy or your data but it's designed to protect the providers and insurance carriers. It's covering their legal asses and maximizing difficulty for everyone else to access information about what they've done to you. It's about protecting their investment. If HIPAA were designed to protect your privacy, then HIPAA would apply to your data or you personally, rather than the narrow scope of regulated entities.