Hacker News Reader

My implication is that there’s no way to link up DNA to an individual without having a reference point. A hospital or lab (both covered entities) would provide this data (perhaps under subpoena?), and would ostensibly be working directly with the forensics lab in these cases. How else would they link up DNA (which is by itself not PHI) to an identity?

View on HN

So then the hospital or lab are under HIPAA, but not the forensic lab.

That's not how it works. If the hospital or lab provides PHI (protected health information) to the forensic lab, the forensic lab must sign a business associate agreement with the HIPAA covered entity that gives assurances to them that any PHI will be protected. If a breach occurs, then the forensic lab is liable for full HIPAA penalties.

Reply on news.ycombinator.com