The HIPAA Exception

23andMe's exemption from HIPAA regulations may come as a surprise to many customers who assume their genetic information is protected under the same laws that govern medical records. However, as a direct-to-consumer genetic testing company, 23andMe falls into a regulatory gray area.

The company argues that this exemption allows for a "more appropriate and transparent model for the data we handle, rather than the HIPAA model employed by the traditional healthcare industry." However, critics contend that this lack of regulatory oversight leaves customers vulnerable.