Genetic information cannot be reissued. A Social Security number is hard to change, a credit card can be replaced within hours, and a password can be changed immediately, which is why the standard breach response of credit monitoring and replacement account numbers exists at all.

Researchers writing in the Berkeley Technology Law Journal describe genetic information as both permanent and resistant to de-identification, placing it outside the categories that breach notification was designed around.

 

The sensitivity increases rather than fades

An academic analysis of genomic privacy published on arXiv makes a point that complicates every retention and risk calculation in healthcare, arguing that genomic data's privacy sensitivity will likely increase over time as the science interpreting it advances.

A record stolen in 2020 therefore reveals more about a person in 2035 than it did on the day it was taken. The same paper identified the realistic leakage routes as a clinician acting carelessly, a breach of hospital IT, or the sequencing facility itself, which places the risk inside ordinary healthcare operations rather than in exotic attack scenarios.

 

One person's data describes several people

Genetic information carries details about relatives who consented to nothing. Writing for Lawfare, analysts described the privacy implications as relational, noting that sharing a genome means sharing parts of a parent's, a child's, and a sibling's genome at the same time.

Breach notification was not built for that. An organization writes to the individuals in its records, and the exposure reaches family members who were never patients, do not appear in any file, and receive no letter.

The 23andMe incident showed the mechanism operating at scale. A technical analysis published on arXiv documented attackers using credential stuffing, meaning login details stolen from unrelated breaches and replayed against another service, to reach a comparatively small number of accounts directly. Reporting on the breach put the eventual total near 6.9 million people, close to half the company's customer base, because the compromised accounts connected outward through the DNA Relatives feature.

 

Where the legal protections stop

The Genetic Information Nondiscrimination Act prohibits discrimination based on genetic information in health insurance and employment, and its reach is narrower than most assume.

Researchers at the Claremont Colleges note that while GINA prevents discrimination, it does not regulate how companies handle, store, or share genetic information outside that context. The arXiv genomic privacy analysis adds that GINA does not apply to life insurance or the military.

HIPAA covers genetic data held by covered entities and business associates, which includes clinical laboratories. It does not reach most direct-to-consumer testing companies, which generally fall outside the definition of a healthcare provider, and the Electronic Privacy Information Center has described the combined gaps across HIPAA, GINA, and the Affordable Care Act as leaving consumers without the protections they believe apply.

State law is reaching further. Washington's My Health My Data Act, which took effect in March 2024, creates a private right of action with treble damages up to $25,000, and Nevada's equivalent allows attorney general penalties of up to $10,000 per violation with no volume threshold at all.

 

What this means for a risk analysis

The Security Rule requires assessing risks to the confidentiality, integrity, and availability of ePHI without differentiating by data type, and the four-factor breach assessment HHS sets out asks specifically about the nature and extent of the PHI involved, including the likelihood of re-identification.

Genetic data answers that question differently from everything else in the record. The Berkeley analysis noted that genetic information is hard to de-identify, and the arXiv work found that anonymised genomic information can frequently be linked back to individuals when combined with public databases or genealogical tools. An assessment concluding low re-identification risk on genetic data is unlikely to survive scrutiny.

 

Where email enters

Laboratories move results constantly between the lab, ordering providers, and patients, and each transmission creates an opportunity for interception or misdirection. Paubox's 2025 Healthcare Email Security Report found employees report 5% of known phishing attempts to their security teams, and the 2026 report recorded a 47% increase in attacks avoiding the defenses built into Microsoft 365 and Google Workspace.

Paubox Email Suite encrypts every outbound message by default and validates the receiving server before sending rather than assuming the connection is secure. Paubox Inbound Email Security reads sender behavior and message intent before delivery.

 

What happens when the company holding it is sold

23andMe's bankruptcy raised a question most privacy frameworks never anticipated, which is what becomes of a genetic database when the organization holding it stops existing.

The Lawfare analysis argued that consent given to one company does not transfer meaningfully to an unknown acquirer operating under different incentives, and recommended prohibiting the commodification and sale of DNA data during bankruptcy proceedings. The concern extends past consumer testing. Clinical laboratories, research biobanks, and digital health companies holding genomic data are all acquirable, and an acquisition moves the data alongside the rest of the balance sheet.

Ambry Genetics is a working example. Its parent company Tempus AI now faces a proposed class action over the alleged unauthorized use and commercialization of genetic information, which is a claim about what happens to data after an acquisition rather than about any breach.

 

FAQs

Why can't genetic data be protected the way other PHI is?

It cannot be changed or reissued after exposure, it describes relatives who never consented, and researchers expect its sensitivity to increase as interpretation improves rather than diminish over time.

 

Does HIPAA cover genetic information?

Yes, when a covered entity or business associate holds it, which includes clinical laboratories. Most direct-to-consumer testing companies fall outside HIPAA because they do not meet the definition of a healthcare provider.

 

What does GINA actually prohibit?

Discrimination based on genetic information in health insurance and employment. It does not extend to life insurance or the military, and it does not govern how organizations store or share the data.

 

How are relatives affected by a breach they are not party to?

Genetic information describes shared inherited material, so exposing one person's data reveals information about their parents, children, and siblings. Those individuals receive no notification because they appear in no record.

 

Should genetic data change how we conduct a risk analysis?

The obligation is identical, but the four-factor breach assessment asks about re-identification likelihood, and research shows anonymised genomic data can often be linked back to individuals using public databases and genealogical tools.

Learn more: HIPAA Compliant Email: The Definitive Guide