Medical information at least is protected by HIPAA.
https://nij.ojp.gov/topics/articles/what-str-analysis
> Among the 3 million or so DNA bases that do not code for proteins are regions with multiple copies of short repeating sequences of these bases, which make up the DNA backbone (for example, TATT). These sequences repeat a variable number of times in different individuals. Such regions are called "variable number short tandem repeats," and they are the basis of STR analysis. A collection of these can give nearly irrefutable evidence statistically of a person's identity because the likelihood of two unrelated people having the same number of repeated sequences in these regions becomes increasingly small as more regions are analyzed.
http://www.biology.arizona.edu/human_bio/activities/blackett...
https://forensicsdigest.com/short-tandem-repeats-or-strs/
This isn't data that you could reconstruct a genetic disease from. It is more akin to a hash function for an individual's genome. The data would be 13 pairs of numbers (13 STR loci and the number of repeats on each chromosome at that location).
This would be PII, but likely not HIPAA.
Labs doing forensic work for police departments are probably not covered entities.
> By law, the HIPAA Privacy Rule applies only to covered entities – health plans, health care clearinghouses, and certain health care providers. However, most health care providers and health plans do not carry out all of their health care activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses. The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.
Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
In the case of a police department collecting DNA data for analysis by a police forensic lab there is no covered entity involved.
Other entities besides most state and local law enforcement that often have medical data but that are not covered by HIPAA include most private employers, state agencies such as child protective services, and most schools and school districts [1].
[1] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/un...