According to Lynn Sessions, an expert on healthcare privacy and digital assets and partner at the law firm BakerHostetler, the federal law that covers patient information privacy, HIPAA, does not apply to this situation, and 23andMe would not be considered a HIPAA-covered entity, or business associate of one. But there are state laws that apply to genetic information that would be in play, such as in California.
Meredith Schnur, a managing director and cybersecurity leader at insurance company Marsh, thinks the risk from 23andMe's bankruptcy for people who sent in their swabs is relatively low. "It doesn't cause any additional consternation or heartburn," Schnur said. "I just don't think it opens up any additional risk that doesn't already exist," she said, adding that many people's information is "already out there."