You have no idea how many ways there are to adhere to the letter of that law while ignoring the intent. There are entire multinational businesses built specifically to facilitate these kinds of data exchanges while keeping it technically legal.
The health insurer doesn't need the genome. It just needs a number from 1 to 10 from a 'de-identified' source to multiply their scores by.