Is There Such a Thing as a HIPAA-Compliant DNA Test?

The phrase “HIPAA-compliant DNA test” is close to a category error, and understanding why changes how you evaluate a genetics provider. HIPAA is the Health Insurance Portability and Accountability Act of 1996, together with the Privacy and Security Rules built on it. It regulates specific kinds of organizations rather than specific kinds of laboratory tests. The rules apply to covered entities. That means health plans and healthcare clearinghouses, plus healthcare providers who transmit health information electronically in connection with a covered transaction such as billing. They also apply to the business associates that handle protected health information on a covered entity’s behalf.

Consider a direct-to-consumer company that sells you a kit, sequences your sample, and returns reports. If it does not bill insurance or operate as your provider, it is usually neither a covered entity nor a business associate. HIPAA then does not apply at all, and no amount of internal policy makes the test itself “HIPAA compliant.”

The picture changes if a physician orders the sequencing and a clinical laboratory runs it and bills electronically. HIPAA does apply in that case, but the consequence is different from what most people assume. HIPAA permits a large amount of sharing for treatment, payment, and healthcare operations. It also puts a copy of your genomic data into your medical record, where it becomes reachable by every downstream system that touches that record.

What HIPAA covers, and what it does not

Before deciding whether HIPAA status tells you anything useful, it helps to be precise about the protections the rules do and do not provide. The Privacy Rule restricts uses and disclosures of protected health information by covered entities and business associates. It also gives you rights of access and amendment. The Security Rule imposes administrative, physical, and technical safeguards. These include access controls and audit logging. Encryption is treated there as an “addressable” specification, meaning risk-assessed rather than strictly required.

What HIPAA does not do is prohibit most of the things people worry about. It does not stop a lab from using your de-identified data for research or commercial product development. It does not cover life, disability, or long-term care insurers. Those insurers also sit outside the Genetic Information Nondiscrimination Act of 2008, since GINA covers health insurance and employment only. HIPAA does not prevent a subpoena or a warrant. And it does not follow the data once you download it or hand it to a third-party interpretation service.

The regulatory boundary around genetic testing is also less settled than marketing copy suggests. Three authorities overlap here. The first is CLIA, the Clinical Laboratory Improvement Amendments that regulate laboratory quality. The others are FDA device authority and the Privacy Rule. Their overlapping claims have produced real ambiguity about who may return which results to whom, and under what conditions.¹ Putting clinical-grade sequence data inside an electronic medical record raises a separate set of conflicts between patient control and research reuse that existing rules resolve poorly.²

The part of HIPAA worth using

HIPAA does offer one provision that is genuinely valuable to you, and that is the right of access. If your sequencing was performed by a covered entity, you can request your designated record set. The American College of Medical Genetics and Genomics has published a points-to-consider statement on what that set includes for genetic and genomic testing. It distinguishes the signed report from underlying data such as alignments and variant calls.³

Laboratories differ in whether they treat BAM and VCF files as part of the record or as part of their internal quality system. It therefore pays to ask in writing and to ask for specific formats. A VCF is a variant call format file, listing the positions where your sequence differs from a reference. A BAM holds the aligned sequencing reads themselves. Three requests are worth making together:

• FASTQ or unaligned BAM for the raw reads.
• A coordinate-sorted BAM or CRAM against a named reference build such as GRCh38 or T2T-CHM13v2.0.
• A gVCF rather than a filtered VCF, so that you keep reference-block confidence and can re-filter the data yourself.

If you cannot obtain raw reads, you are left with a report and nothing to reanalyze. That is the practical argument for choosing a provider whose default deliverable is the data, regardless of HIPAA status.

Read the contract, not the compliance badge

A compliance badge on a consumer genetics site tells you very little. We would ignore any “HIPAA compliant” claim and read six clauses instead. Each one describes a way your data can move without your involvement.

The first is secondary use. Is research use a separate, affirmative opt-in, or is it bundled into the terms of service? Is the consent broad (“future research”) or specific? Broad consent for whole-genome data is a poor fit for the ethical framework that governed single-gene studies. A genome supports indefinite future questions that nobody described at the time of collection.⁴

The second is retention of the physical sample. Deleting a file does not destroy the biobanked saliva or blood, and a retained sample can be re-sequenced later. Ask whether deletion includes sample destruction and whether you receive written attestation.

The third is deletion mechanics. Look for the stated window and for whether backups and derived intermediates are included. Those intermediates cover FASTQ, BAM, and per-sample QC databases. Ask also whether already-distributed research copies can be recalled. They usually cannot.

The fourth is law enforcement policy. Require a stated standard, meaning a warrant for genetic data rather than a subpoena. Require also a transparency report giving counts, plus a commitment to notify you unless the company is legally barred from doing so.

The fifth is corporate change of control. Genetic databases are assets, and a bankruptcy or acquisition can transfer the database under the acquirer’s policies. Look for a clause that binds successors to the original consent or requires re-consent.

The sixth is subprocessors and jurisdiction: which cloud, which region, whose keys. Cloud analysis of genomic data is defensible, but the security model has to be designed rather than assumed. Customer-managed keys, private networking, and audit trails belong in the contract as explicit requirements.⁵

Genomes cannot be de-identified

Contractual terms matter more than de-identification promises for one central reason. Genomes resist de-identification in principle. The HIPAA Safe Harbor method lists eighteen identifiers to strip, and sequence data is not among them. This is a structural weakness rather than an oversight that can be patched.

A few dozen independent common SNPs are enough to pick one person out of a population. SNPs are single-letter variants that differ between people. A “de-identified” VCF is therefore a unique identifier of a known person combined with a phenotype prediction engine. The identifiability of whole-genome data has been clear since the earliest analyses of individual genome sequencing, as has its extension to relatives who never consented.⁶ This is also why surreptitious collection is a real risk with weak legal remedies. US law protects shed biological material inconsistently, and consent requirements vary by state.⁷

A setup we would use for self-custody

Once you hold the files, you are the security perimeter, so the handling details are worth getting right from the start. Start with the sizes involved. A 30x whole genome means each position in the genome is covered by roughly thirty independent sequencing reads on average. That is roughly 80–120 GB as BAM and 25–40 GB as CRAM 3.0. CRAM is a compressed format that is lossless provided you keep the exact reference FASTA. Convert and verify:

samtools view -T GRCh38_full_analysis_set_plus_decoy_hla.fa -C -o me.cram me.bam
samtools quickcheck -v me.cram && samtools index me.cram
md5sum -c delivered.md5

Before you build anything on the file, confirm that it is you. Compare it against an independent genotype source such as an array VCF:

bcftools gtcheck -g array.vcf.gz me.g.vcf.gz

Encrypt at rest with something you control. age is the simplest defensible choice (age -r <recipient-key> -o me.cram.age me.cram). Crypt4GH is the GA4GH-standard container if you need to exchange encrypted genomic data with a collaborator who expects that format. For backups, restic with a strong repository password gives you client-side encryption and deduplication to any object store, so the storage provider never sees plaintext. Keep the key material off the same disk, and write down who inherits it.

For analysis, prefer local or single-tenant compute. Uploading a VCF to a free interpretation website is the single most common way people lose control of their genome. The upload is usually governed by terms that permit retention and research use. If you want an AI agent to reason over your data, run the extraction locally and send the smallest sufficient slice rather than the whole variant call set.

Interpretation of any specific pathogenic or likely-pathogenic finding belongs with a clinical geneticist or genetic counselor. That person can order confirmatory testing in a CLIA laboratory and place the result in the context of your family history. Research-grade calls are not a clinical result, and that includes anything from a 30x short-read pipeline in low-complexity or repeat regions.

Questions people also ask

Is 23andMe HIPAA compliant? Direct-to-consumer genetics companies generally do not operate as HIPAA covered entities for the consumer product, so HIPAA does not govern the data. Their privacy commitments come from their own terms of service and from state law such as the Illinois and California genetic privacy statutes. Those commitments can be changed or transferred with the company.

Can police access 23andMe? With valid legal process, yes, and companies publish transparency reports on the requests they receive. The larger exposure is indirect. Forensic genetic genealogy identifies people through relatives’ profiles on services that permit law enforcement matching, so a cousin’s upload can implicate you without your involvement.

Should I delete my DNA from 23andMe? If you have already downloaded your raw genotype file, deletion reduces your exposure at little cost to you. Send a deletion request and separately request destruction of the stored saliva sample. Ask for written confirmation, recognizing that data already shared with research partners is unlikely to be recallable.

Is genetic testing protected by HIPAA? Only when a covered entity or its business associate holds it. Clinical testing ordered through a physician is covered, and HIPAA then gives you access rights to the designated record set.³ Consumer testing bought directly is typically outside HIPAA entirely.

Can you sue someone for doing a DNA test without consent? Sometimes, depending on the state. Several states criminalize or create civil liability for non-consensual genetic testing. Coverage of abandoned biological material is patchy, however, and the available remedies are weaker than most people expect.⁷

Woolf Software builds longitudinal molecular profiles of individuals: whole-genome sequencing, RNA sequencing, proteomics, blood biomarkers, and continuous glucose data, integrated into one model of you. Build your profile.

Footnotes

1. Barbara J. Evans, Michael O. Dorschner, Wylie Burke, et al. Regulatory changes raise troubling questions for genomic testing. Genetics in Medicine, 2014. https://doi.org/10.1038/gim.2014.127 ↩

2. Jennifer Kulynych, Henry T. Greely. Clinical genomics, big data, and electronic medical records: reconciling patient rights with research when privacy and science collide. Journal of Law and the Biosciences, 2017. https://doi.org/10.1093/jlb/lsw061 ↩

3. Marwan K. Tayeh, Margaret Chen, Stephanie M. Fullerton, et al. The designated record set for clinical genetic and genomic testing: A points to consider statement of the American College of Medical Genetics and Genomics (ACMG). Genetics in Medicine, 2023. https://doi.org/10.1016/j.gim.2022.11.010 ↩ ↩²

4. Holly K. Tabor, Benjamin E. Berkman, Sara Chandros Hull, et al. Genomics really gets personal: How exome and whole genome sequencing challenge the ethical framework of human genetics research. American Journal of Medical Genetics Part A, 2011. https://doi.org/10.1002/ajmg.a.34357 ↩

5. Alexis B. Carter. Considerations for Genomic Data Privacy and Security when Working in the Cloud. The Journal of Molecular Diagnostics, 2019. https://doi.org/10.1016/j.jmoldx.2018.07.009 ↩

6. John A. Robertson. The $1000 Genome: Ethical and Legal Issues in Whole Genome Sequencing of Individuals. The American Journal of Bioethics, 2003. https://doi.org/10.1162/152651603322874762 ↩

7. Shedding Privacy Along With our Genetic Material: What Constitutes Adequate Legal Protection against Surreptitious Genetic Testing?. AMA Journal of Ethics, 2016. https://doi.org/10.1001/journalofethics.2016.18.3.pfor2-1603 ↩ ↩²