Hacker News Reader

Comment by JohnJamesRambo | Hacker News Reader

Isn’t DNA sequencing my medical information and protected by HIPAA and other privacy laws? Can the police search my medical records without a warrant?

View on HN

> Isn’t DNA sequencing my medical information and protected by HIPAA and other privacy laws?

It would depend on the context of how the DNA sequencing was provided.

If your Doctor ordered it as part of a treatment plan and billed your health insurance, then yes, it's a medical record covered by HIPAA.

If you personally ordered DNA sequencing and gave the results to GEDmatch, then HIPAA does not apply. GEDmatch is neither a Covered Entity[1] nor Business Associate[2] of a Covered Entity. From a legal perspective the DNA database at GEDmatch is no different than phone or banking records.

[1] https://www.hhs.gov/hipaa/for-professionals/covered-entities...

[2] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

Not since Smith vs. Maryland, one of the SCOTUS’ truly awful rulings.

https://www.theatlantic.com/technology/archive/2013/12/what-...

The police can ask you for something without a warrant. You can say no. When they ask a 3rd party like the phone company they are free to say yes and comply if they want. I dont think that would apply to data protected under HIPPA though, which by law is not to be shared without the persons comcent. But IANAL.

The problem is that the data obtained via a third party, without a warrant, is admissible in court. And IANALE, but HIPAA has exclusions and exemptions for law enforcement.

HIPAA doesn't apply to everyone. There's a definition for "covered entities". For example, if you tell me about your medical condition, I can tell anyone I like.

I can't find any reference to HIPAA in 23andme's privacy policy and I don't believe they are currently considered a covered entity. I don't even know if their data is considered medical information in the same way a diagnosis would be.

Yeah, the cops can search your medical records if you printed them out and left them with a friend and that friend gave the cops access to them.

HIPAA only applies to "covered entities" and their business partners, which are (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. GEDmatch is none of those.

Reply on news.ycombinator.com