Labs doing forensic work for police departments are probably not covered entities.
> By law, the HIPAA Privacy Rule applies only to covered entities – health plans, health care clearinghouses, and certain health care providers. However, most health care providers and health plans do not carry out all of their health care activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses. The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.
Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
In the case of a police department collecting DNA data for analysis by a police forensic lab there is no covered entity involved.
Other entities besides most state and local law enforcement that often have medical data but that are not covered by HIPAA include most private employers, state agencies such as child protective services, and most schools and school districts [1].
[1] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/un...