These organization often sell genetic screening services, and I don't see how that is not providing medical services.
HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.
> Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0]
My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse.
> Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1]
[0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp
https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-cover...
Like I said, most people are very surprised to learn this fact.
But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare services directly may be considered a covered entity.
>Entities that provide data transmission of PHI on behalf of a covered entity (or its business associate) and that require access on a routine basis to that PHI (such as regional Health Information Organizations (HIOs)) are considered to be business associates under HIPAA
Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach.
[0]: https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/