Explainer

Your DNA data: privacy, HIPAA and GINA

What federal agencies and regulations say about who can see, share and use the results of a test you buy yourself. Each quote is a starting point, not a full statement of the law.

Gift-buyer's privacy checklist

Built from the FTC's December 2023 consumer alert, “If DNA test kits are on your holiday shopping list” (Internet Archive copy, May 13, 2026; original), and its June 2023 alert on DNA privacy. Tick items off as you go; nothing is saved.

• Read the company's privacy policy before you buy. FTC: “Take a close look at the company’s privacy promises.”
• Find out whether it shares users' information with other companies. FTC: “Do they share users’ information with other companies?”
• Check that you can delete your information later. FTC: “Can you delete your information if you want to?”
• Read the terms of use: who gets access and how data is protected. FTC: “Read and understand the company’s “terms of use” before you buy.”
• Help the recipient set a strong password used nowhere else. FTC: “They’ll need a strong password they haven’t used on any other website.”
• Change the default privacy settings to the most protective ones. FTC: “Don’t just settle for out-of-the-box defaults. They may not offer the most protection.”
• Remember the results describe relatives too. FTC: “It tells a story not just about you, but also about people you’re related to.”

The FTC also warns: “Even if a company promises not to share data with others, hack attacks still happen.” (FTC, archived May 13, 2026)

Who can see your DNA data

In its section on direct-to-consumer genetic testing, NIH's National Human Genome Research Institute writes:

While many companies have robust privacy and informed consent policies, no federal laws prohibit companies from providing individuals’ genetic information to third parties.

That is a broad summary, not a complete statement of the law. NHGRI's same paragraph goes on: “the Federal Trade Commission provides some protections and can take enforcement action against companies that make false or misleading statements regarding data privacy and security or companies that fail to protect individuals’ information.” (NHGRI) HIPAA can also apply when the data is held by a HIPAA-covered entity or a business associate of one; see HIPAA below.

MedlinePlus lists more risks to know about:

• “if a direct-to-consumer genetic testing company changes ownership, goes out of business, or declares bankruptcy, your genetic information may be transferred or sold.” (MedlinePlus)
• “Direct-to-consumer genetic testing companies may be required to disclose genetic information to law enforcement officials.” (MedlinePlus)
• “Because relatives share genetic information, your results may have implications for other members of your family.” (MedlinePlus)
• “Receiving unexpected information about your health, family relationships, or ancestry may be upsetting.” (MedlinePlus)

NHGRI on moving your raw data to another service: “Importantly, if an individual chooses to download their genetic information from one of these services or upload it to another, the company that originally collected the data is no longer responsible for any breach of privacy that may occur.” (NHGRI) That sentence is about the copy you download or upload elsewhere. It doesn't describe the original company's responsibilities for the data it still holds.

One upside MedlinePlus notes: “The results are provided directly to you and are not placed in your medical record (unless you share the results with your healthcare provider).” (MedlinePlus)

What the FTC has done

1Health.io (Vitagene), 2023

In a June 2023 complaint, the FTC said the company stored “nearly 2,400 health reports about consumers and raw genetic data of at least 227 consumers” (FTC press release, archived Sep 30, 2026) in publicly accessible cloud storage. On the company's 2020 privacy-policy change, the FTC's consumer protection director said: “The FTC Act prohibits companies from unilaterally applying material privacy policy changes to previously collected data.” (FTC, archived Sep 30, 2026)

23andMe bankruptcy, 2025

On March 31, 2025, the FTC chairman sent a letter to the U.S. Trustee in 23andMe's bankruptcy case, “expressing the concerns American consumers have with the potential sale or transfer of their 23andMe data.” (FTC press release, archived Jun 22, 2026) The chairman said: “Consumers should be able to trust that companies will keep their promises, including when it comes to handling of sensitive information.” (FTC, archived Jun 22, 2026)

HIPAA

HIPAA's rules apply to particular entities, not to genetic information wherever it is. The regulation says:

the standards, requirements, and implementation specifications adopted under this subchapter apply to the following entities: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate.

A business associate, in the definitions, is a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter” (45 CFR 160.103)

NHGRI summarizes it this way: the HIPAA “Privacy Rule protects the confidentiality of patients’ individually identifiable health information — or Protected Health Information (PHI) — that HIPAA-covered entities (e.g., health care providers or an insurance company) hold.” (NHGRI) It adds that in 2013, “the Privacy Rule was modified to establish that genetic information is considered PHI” (NHGRI).

So whether HIPAA covers a test you buy yourself depends on whether the company holding your results is one of these entities, or a business associate of one, for that test. FDA records don't say, and this site can't tell you; the company's privacy notice is the place to ask. (We tried to quote HHS's own HIPAA pages, but hhs.gov refuses automated requests, so we quote the regulation text on eCFR and NIH's summary.)

GINA

“The Genetic Information Nondiscrimination Act (GINA) of 2008 protects Americans from discrimination based on their genetic information in both health insurance (Title I) and employment (Title II).” (NHGRI, Genetic Discrimination) The law defines genetic information broadly. The EEOC: “Genetic information includes information about an individual's genetic tests and the genetic tests of an individual's family members, as well as information about the manifestation of a disease or disorder in an individual's family members (i.e. family medical history).” (EEOC)

• Health insurance: “health insurers may not use genetic information to determine if someone is eligible for insurance or to make coverage, underwriting or premium-setting decisions.” (NHGRI) Also, “health insurers may not request or require individuals or their family members to undergo genetic testing or to provide genetic information.” (NHGRI) “The Departments of Labor, Health and Human Services and the Treasury have responsibility for issuing regulations for Title I of GINA, which addresses the use of genetic information in health insurance.” (EEOC)
• Work: “Title II of GINA prohibits the use of genetic information in making employment decisions, restricts employers and other entities covered by Title II (employment agencies, labor organizations and joint labor-management training and apprenticeship programs - referred to as "covered entities") from requesting, requiring or purchasing genetic information, and strictly limits the disclosure of genetic information.” (EEOC) The EEOC adds: “An employer may never use genetic information to make an employment decision because genetic information is not relevant to an individual's current ability to work.” (EEOC)
• Manifested disease: GINA's employment title is about genetic information, not a disease you already have. It says a covered employer “shall not be considered to be in violation of this title based on the use, acquisition, or disclosure of medical information that is not genetic information about a manifested disease, disorder, or pathological condition of an employee or member, including a manifested disease, disorder, or pathological condition that has or may have a genetic basis.” (GINA Title II, Sec. 210, on EEOC's site)
• Not covered: “GINA’s health insurance protections do not cover long-term care insurance, life insurance, or disability insurance” (NHGRI). FDA says “Receiving a genetic testing result may impact your purchase of life, disability, and long-term care insurance.” (U.S. Food and Drug Administration)
• Small employers: “GINA does not apply to employers with fewer than 15 employees.” (NHGRI)
• The military: “The military is permitted to use genetic information to make employment decisions.” (NHGRI)

The "free genetic test" scam

HHS's Office of Inspector General warns Medicare beneficiaries about genetic testing fraud:

If a genetic testing kit is mailed to you, don't accept it unless it was ordered by your physician.

Be suspicious of anyone who offers you "free" genetic testing and then requests your Medicare number.

Reporting a problem with a test

“Problems should be reported both to the FDA and the company whenever a consumer suspects that there is an issue with a direct-to-consumer test.” (U.S. Food and Drug Administration) FDA's MedWatch program takes reports from consumers.