There still has to be a covered entity involved. The HIPAA business associate rules are for business associates of covered entities.

In the case of a police department collecting DNA data for analysis by a police forensic lab there is no covered entity involved.

Other entities besides most state and local law enforcement that often have medical data but that are not covered by HIPAA include most private employers, state agencies such as child protective services, and most schools and school districts [1].

[1] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/un...